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Abstract 

The general adversary bound is a semi-definite program (SDP) that lower-bounds the quan- 
tum query complexity of a function. We turn this lower bound into an upper bound, by giving a 
quantum walk algorithm based on the dual SDP that has query complexity at most the general 
adversary bound, up to a logarithmic factor. 

In more detail, the proof has two steps, each based on "span programs," a certain linear- 
algebraic model of computation. First, we give an SDP that outputs for any boolean function a 
span program computing it that has optimal "witness size." The optimal witness size is shown 
to coincide with the general adversary lower bound. Second, we give a quantum algorithm for 
evaluating span programs with only a logarithmic query overhead on the witness size. 

The first result is motivated by a quantum algorithm for evaluating composed span programs. 
The algorithm is known to be optimal for evaluating a large class of formulas. The allowed gates 
include all constant-size functions for which there is an optimal span program. So far, good 
span programs have been found in an ad hoc manner, and the SDP automates this procedure. 
Surprisingly, the SDP's value equals the general adversary bound. A corollary is an optimal 
quantum algorithm for evaluating "balanced" formulas over any finite boolean gate set. 

The second result broadens span programs' applicability beyond the formula evaluation 
problem. We extend the analysis of the quantum algorithm for evaluating span programs. The 
previous analysis shows that a corresponding bipartite graph has a large spectral gap, but only 
works when applied to the composition of constant-size span programs. We show generally that 
properties of eigenvalue-zero eigenvectors in fact imply an "effective" spectral gap around zero. 

A strong universality result for span programs follows. A good quantum query algorithm for 
a problem implies a good span program, and vice versa. Although nearly tight, this equivalence 
is nontrivial. Span programs are a promising model for developing more quantum algorithms. 
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1 Introduction 



Quantum algorithms for evaluating formulas have developed rapidly since the breakthrough AND- 
OR formula-evaluation algorithm |FGG07| . The set of allowed gates in the formula has increased 
from just AND and OR gates to include all boolean functions on up to three bits, e.g., the three- 
majority function, and many four-bit functions — with certain technical balance conditions. Op- 
erationally, these new algorithms can be interpreted as evaluating "span programs," a certain 
linear-algebraic computational model |KW93] . Discovering an optimal span program for a function 
immediately allows it to be added to the gate set |RS08 . 
This paper is motivated by three main puzzles: 

1. Can the gate set allowed in the formula-evaluation algorithm be extended further? Given 
that the search for optimal span programs has been entirely ad hoc, yet still quite successful, 
it seems that the answer must be yes. How far can it be extended, though? 

2. What is the relationship between span program complexity, or "witness size," and the adver- 
sary lower bounds on quantum query complexity? There are two different adversary bounds, 
Adv < Adv^, but the power of the latter is not fully understood. Span program witness size 
appears to be closely connected to these bounds. For example, so far all known optimal span 
programs are for functions / with Adv(/) = Adv^(/). 

3. Aside from their applications to formula evaluation, can span programs be used to derive 
other quantum algorithms? 

Our first result answers the first two questions. Unexpectedly, we find that for any boolean func- 
tion /, the optimal span program has witness size equal to the general adversary bound Adv^(/). 
This result is surprising because of its broad scope. It allows us to optimally evaluate formulas over 
any finite gate set, quantumly. Classically, optimal formula-evaluation algorithms are known only 
for a limited class of formulas using AND and OR gates, and a few other special cases. 

This result suggests a new technique for developing quantum algorithms for other problems. 
Based on the adversary lower bound, one can construct a span program, and hopefully turn this 
into an algorithm, i.e., an upper bound. Unfortunately, it has not been known how to evaluate 
general span programs. The second result of this paper is a quantum algorithm for evaluating span 
programs, with only a logarithmic query overhead on the witness size. The main technical difficulty 
is showing that a corresponding bipartite graph has a large spectral gap. We show that properties 
of eigenvalue-zero eigenvectors in fact imply an "effective" spectral gap around zero. 

In combination, the two results imply that the general quantum adversary bound, Adv^, is tight 
up to a logarithmic factor for every boolean function. This is surprising because Adv^ is closely 
connected to the nonnegative- weight adversary bound Adv, which has strong limitations. The 
results also imply that quantum computers, measured by query complexity, and span programs, 
measured by witness size, are equivalent computational models, up to a logarithmic factor. 

Some further background material is needed to place the results in context. 
Quantum algorithms for evaluating formulas 

Farhi, Goldstone and Gutmann in 2007 gave a nearly optimal quantum query algorithm for eval- 
uating balanced binary AND-OR formulas ^FGGOTl ICCJY07] . This was extended by Ambainis et 
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al. to a nearly optimal quantum algorithm for evaluating all AND-OR formulas, and an optimal 



quantum algorithm for evaluating "approximately balanced" AND-OR formulas ACR^07 . 

Reichardt and Spalek gave an optimal quantum algorithm for evaluating "adversary-balanced" 
formulas over a considerably extended gate set plS08], including in particular: 

• Ah functions {0, 1}" {0, 1} for n < 3, such as AND, OR, PARITY and MAJ3. 

• 69 of the 92 inequivalent functions / : {0, l}"^ {0,1} with Adv(/) = Adv=^(/) ([Defini- 



tion 2.4). 



They derived this result by generalizing the previous approaches to consider span programs, 
a computational model introduced by Karchmer and Wigderson |KW93j . They then derived a 
quantum algorithm for evaluating certain concatenated span programs, with a query complexity 



upper-bounded by the span program witness size (Definition 2.3). Thus in fact the allowed gate 
set includes all functions / : {0,1}'^ — > {0,1}, with n = (1), for which w e have a span program P 
computing / and with witness size wsize(P) = Adv^(/) (Definition 2.4). A special case of (RS08 
Theorem 4.7] is: 



Theorem 1.1 (jRSol]). Fix a function f : {0,1}" {0,1}. For k £N, define f : {0,1}' 



or 



{0,1} as follows: f^ = f and f^{x) = f{f'' ^{xi, . . . , x^k-i), . . . , f'' ^{x^k.^k-i+i, ■ ■ ■ ,Xnk)) /< 
k > 1. If span program P computes f, then 

Qif') = 0(wsize(P)'=) , (1.1) 

where Q{f^) is the bounded-error quantum query complexity of f^ . 



|RS08| followed an ad hoc approach to finding optimal span programs for various functions. 
Although successful so far, continuing this method seems daunting: 

• For most functions /, probably Adv^(/) > Adv(/). Indeed, there are 222 four-bit boolean 
functions, up to the natural equivalences, and for only 92 of them does Adv^ = Adv hold. 
For no function with a gap has a span program matching Adv^(/) been found. This suggests 
that perhaps span programs can only work well for the rare cases when Adv^ = Adv. 

• Moreover, for all the functions for which we know an optimal span program, it turns out 
that an optimal span program can be built just by using AND and OR gates with optimized 



weights. (This fact has not been appreciated; see Appendix A ) On the other hand, there is 



no reason to think that optimal span programs will in general have such a limited form. 

• Finally, it can be difficult to prove a span program's optimality. For several functions, we 
have found span programs whose witness sizes match Adv numerically, but we lack a proof. 

In any case, the natural next step is to try to automate the search for good span programs. 
A main difficulty is that there is considerable freedom in the span program definition, e.g., span 
programs are naturally continuous, not discrete. The search space needs to be narrowed down. 

We show that it suffices to consider span programs written in so-called "canonical" form. This 
form was introduced by |KW93j . but its significance for developing quantum algorithms was not 
at first appreciated. We then find a semi-definite program (SDP) for varying over span programs 
written in canonical form, optimizing the witness size. This automates the search for span programs. 

Remarkably, the SDP has a value that corresponds exactly to the general adversary bound 
Adv^, in a new formulation. Thus we characterize optimal span program witness size: 
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Theorem 1.2. For any function f : {0, 1}" {0, 1}, 

infwsize(P) = Adv=^(/) , (1.2) 

where the infimum is over span programs P computing f. Moreover, this infimum is achieved. 



This result greatly extends the gate set over which the formula-evaluation algorithm of |RS08 
works optimally. In fact, it allows the algorithm to run on formulas with any finite gate set. A 
factor is lost that depends on the gates, but for a finite gate set, this will be a constant. As another 



corollary. Theorem 1.2 also settles the question of how the general adversary bound behaves under 



function composition, and it implies a new upper bound on the sign-degree of boolean functions. 
Quantum algorithm for evaluating span programs 

Now that we know there are span programs with witness size matching the general adversary bound, 
it is of considerable interest to extend the formula-evaluation algorithm to evaluate arbitrary span 



programs. Unfortunately, though, a key theorem from |RS08| does not hold general span programs. 



The |RS08j algorithm works by plugging together optimal span programs for the individual 
gates in a formula (p to construct a composed span program P that computes if. Then a family of 
related graphs Gp{x), one for each input x, is constructed. For an input x, the algorithm starts 
at a particular "output vertex" of the graph, and runs a quantum walk for about l/wsize(P) steps 
in order to compute ip{x). The algorithm's analysis has two parts. First, for completeness, it is 
shown that when (p{x) = 1, there exists an eigenvalue-zero eigenvector of the weighted adjacency 
matrix ^Gp(a;) with large support on the output vertex. Second, for soundness, it is shown that 
if ip{x) = 0, then Aqp(^^-j has a spectral gap of r2(l/wsize(P)) for eigenvectors supported on the 
output vertex. This spectral gap determines the algorithm's query complexity. 

The completeness step of the proof comes from relating the definition of Gp{x) to the wit- 
ness size definition. Eigenvalue-zero eigenvectors correspond exactly to span program "witnesses," 
with the squared support on the output vertex corresponding to the witness size. This argument 
straightforwardly extends to arbitrary span programs. 

For soundness, the proof essentially inverts the matrix AQpi^^-^ — pi gate by gate, span program 
by span program, starting at the inputs and working recursively toward the output vertex. In this 
way, it roughly computes the Taylor series about p = of the eigenvalue-/? eigenvectors in order 
eventually to find a contradiction for \p\ small. One would not expect this method to extend to 
arbitrary span programs, because it loses a constant factor that depends badly on the individual 
span programs used for each gate. Indeed, it fails in general. Span programs can be constructed 
for which the associated graphs simply do not have an r2(l/wsize(P)) spectral gap in the case. 
(For example, take a large span program and add an AND gate to the top whose other input is 0. 
The composed span program computes the constant function and has constant witness size, but 
the spectral gaps of the associated large graphs need not be (1).) 



On the other hand, it has not been understood why the |RS08] analysis works so well when 
applied to balanced compositions of constant-size optimal span programs. In particular, the corre- 
spondence between graphs and span programs by definition relates the witness size to properties of 
eigenvalue-zero eigenvectors. Why does the witness size quantity also appear in the spectral gap? 

We show that this is not a coincidence, that in general an eigenvalue-zero eigenvector of a 
bipartite graph implies an "effective" spectral gap for a perturbed graph. Somewhat more precisely, 
the inference is that the total squared overlap on the output vertex of small-eigenvalue eigenvectors 
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is small. This argument leads to a substantially more general small-eigenvalue spectral analysis. 



It also implies simpler proofs of Theorem 1.1 as well as of the AND- OR formula-evaluation result 
in |ACR+07l . 

This small-eigenvalue analysis is the key step that allows us to evaluate span programs on a 
quantum computer. Besides showing an effective spectral gap, though, we would also need to bound 
II^Gpll in order to generalize [RSOS] . However, recent work by Cleve et al. shows that this norm 
does not matter if we are willing to concede a logarithmic factor in the query complexity jCGM^OS 
We thus obtain: 



Theorem 1.3. Let P be a span program computing f : {0, 1}" {0, 1}. Then 

nif\ n( ■ fT3\ logwsize(P) 

Qif) = 0[ wsize(P - — ■ 

\ log log wsize(P) 



(1.3) 



We can now prove the main result of this paper, that for any boolean function / the general 
adversary bound on the quantum query complexity is tight up to a logarithmic factor: 

Theorem 1.4. For any function f : {0, 1}" — > {0, 1}, the quantum query complexity of f satisfies 

Q(/)=17(Adv±(/)) and Q(/) = o(Adv^(/) /°f ^ff ) . (1.4) 

V loglogAdv=^(/)y 



Proof. The lower bound is due to HLS07] (see Theorem 2.6). For the upper bound, use the SDP 
from Theorem 1.2 to construct a span program P computing /, with wsize(P) = Adv^(/). Then 
apply Theorem 1.3 to obtain a bounded-error quantum query algorithm that evaluates /. □ 



Thus the Adv^ semi-definite program is in fact an SDP for quantum query complexity, up to 
a logarithmic factor. Previously, Barnum et al. have already given an SDP for quantum query 
complexity |BSS03] . and have shown that the nonnegative- weight adversary bound Adv can be 
derived by strengthening it, but their SDP is quite different. In particular, the Adv^ SDP is 
"greedy," in the sense that it considers only how much information can be learned using a sin- 
gle query; see Definition 2.4 below. The i BSS03j SDP, on the other hand, has separate terms 



for every query. It is surprising that a small modification to Adv can not only break the cer- 
ticate complexity and property testing barriers (HLS07 , but in fact be nearly optimal always. 
For example, for the Element Distinctness problem with the input in [n]" specified in binary, 
Adv(J]_^0{y/nlogn) jSSOGj but Q{f) = ^(n^/^) by the polynomial method [ASM lAmbOSj . 
Theorem 1.4 implies that Adv^(/) = fl{n?^^ /log n). 



2 Definitions 

For a natural number n G N, let [n] = {1,2, . . . , n}. Let B = {0, 1}. For a bit 6 G -B, let 6 = 1 — 6 
denote its complement. A function / with codomain 5 is a (total) boolean function if its domain 
is for some n G N; / is a partial boolean function if its domain is a subset P C B^. 

The complex and real numbers are denoted by C and R, respectively. For a finite set X, let 
be the inner product space C^'^^ with orthonormal basis : x £ X}. We assume familiarity 
with ket notation, e.g., X^^-gx I^X^I ~ ^ identity on C'^ . For vector spaces V and W over C, 
let C{V, W) denote the set of all linear transformations from V into W, and let C{V) = C{V, V). 
For A G C{V, W), \\A\\ is the operator norm of A. 
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The union of disjoint sets is sometimes denoted by U. 

In the remainder of this section, we will de fine sp an programs, from [KW93] . and the "witness 



size" span program complexity measure from |RS08j . We will then define the quantum adversary 



bounds and state some of their basic properties, including composition, lower bounds on quantum 
query complexity, and the previously known lower bound on span program witness size. 

2.1 Span programs 

A span program P is a certain linear-algebraic way of specifying a boolean function fp [KW93| 
IGP03| . Roughly, a span program consists of a target \t) in a vector space V, and a collection of 
subspaces Vj^ C V, for j £ [n], b G B. For an input x G 5", fp{x) = 1 when the target can be 
reached using a linear combination of vectors in Uj^[n]^j,Xj- For our complexity measure on span 
programs, however, it will be necessary to fix a set of "input vectors" that span each subspace Vj^. 
We desire to span the target using a linear combination of these vectors with small coefficients. 
Formally we therefore define a span program as follows: 

Definition 2.1 (Span program |KW93] ) . Let n G N. ^ span program P consists of a "target" 
vector \t) in a finite- dimensional inner-product space V over C, together with "input" vectors 
\vi) £ V for i £ I. Here the index set I is a disjoint union I = /free U Uje[n] beB hfi- 
To P corresponds a function fp : B, defined by 

fp{x) = 1^ ^ Span{{\vi) : i G /free U Uje[„] Ij,x,}) 

1 otherwise 

We say that /free indexes the set of "free" input vectors, while Ij^h indexes input vectors "labeled 
by" {j-ib). We say that P "computes" the function fp. For x G /?", fp{x) evaluates to 1, or true, 
when the target can be reached using a linear combination of the "available" input vectors, i.e., 
input vectors that are either free or labeled by {j,Xj) for j G [n]. 

Some additional notation will come in handy. Let {\i) : z G /} be an orthonormal basis for C'^L 
Let A : C'^l — > y be the linear operator 

A = Y,\v^m■ (2.2) 

Written as a matrix, the columns of A are the input vectors of P. For an input x G /?", let I{x) 
be the set of available input vector indices and n(x) : C'^' C'^' the projection thereon, 

I{x) = /free U IJ /j, (2.3) 

n(x) = 10(^1 • (2-4) 

Lemma 2.2. For a span program P, fp{x) = 1 if and only if \t) G Range(j4n(x)). Equivalently, 
fp{x) = if and only ifU{x)A^t) G Range U{x)A^(l - ^ 



[Lemma 2.2 follows from Eq. |(2.1) Therefore exactly when fp{x) = 1 is there a "witness" 



\w) 



G C'^' satisfying j4n(x)|ii;) = \t). Exactly when fp{x) = 0, there is a witness \w') G V 
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satisfying {t\w') ^ and Il{x)A^\w') = 0, i.e., \w') has nonzero inner product with the target 
vector and is orthogonal to the available input vectors. 



The complexity measure we use to characterize span programs is the witness size |RS08j : 
Definition 2.3 (Witness size with costs jRSoU). 

Consider a span program P, and a vector s G 
[0, oo)" of nonnegative "costs." Let S = X]je[n] beB iei ^ V^I^X^I- -^'^'^ ^'^'^^ input x E B^, define 
the witness size of P on x with costs s, wsizes(P, x), as follows: 

• If fp{x) = 1, then \t) G Range(^n(x)), so there is a witness \w) G C'^'^l satisfying An{x)\w) = 
\t). Then wsizes(P, x) is the minimum squared length of any such witness, weighted by the 
costs s: 

wsize,(P,x)= min ||5|u;)f . (2.5) 

\w): AU{x)\w)=\t) 

• If fp{x) = 0, then \t) ^ Range(^n(x)). Therefore there is a witness \w') G V satisfying 
{t\w') = 1 and Ii{x)A'^\w') = 0. Then 

wsize^(P,x)= min ||S'^V'>f • (2-6) 

\w'): (t|ui') = l 
n(x)At|io')=0 

The witness size of P with costs s, restricted to domain D C B"", is 

wsizes(-P, 2?) = maxwsizes(P, x) . (2.7) 

The wsizes(-P, 2?) notation is for handling partial boolean functions. For the common case that 
D = B^, let wsizes(P) = wsizes(P, i?"). For j G [n], sj can intuitively be thought of as the charge 
for evaluating the jth input bit. When the subscript s is omitted, the costs are taken to be uniform, 
s = 1 = (1, 1, . . . , 1), e.g., wsize(P) = wsizej'(P). In this case, note that S = 1 — 10(^1- '^^^ 

extra generality of allowing nonuniform costs is necessary for considering unbalanced formulas. 

Before continuing, let us remark that the above definition of span programs differs slightly 
from the original definition due to Karchmer and Wigderson |KW93] . Call a span program strict 
if /free = 0- Ref. |KW93] considers only strict span programs. For the witness size complexity 



measure, we will later prove that span programs and strict span programs are equivalent (Propo- 



sition 4.10). Allowing free input vectors is often convenient for defining and composing span 
programs, though, and may be necessary for developing efficient quantum algorithms based on 
span programs. Ref. IRSOB I uses an even more relaxed span program definition than 



Definition 2.1 



letting each input vector to be labeled by a subset of [n] x B. This definition is convenient for terse 
span program constructions, and is also easily seen to be equivalent to ours. 

Classical applications of span programs have used a different complexity measure, the "size" of 
P being the number of input vectors, This measure has been characterized in |Gal01] . 

Note that replacing the target vector \t) by c\t), for c 7^ 0, changes the witness sizes by a factor 
of |c|^ or l/|c|^, depending on whether fp{x) = 1 or 0. Thus we might just as well have defined 
the witness size as 



max wsizes(P, x) max wsizes(P, x) , (2.8) 

^:/p(^)=0 x:fp(x) = l 

provided that fp is not the constant or constant 1 function on T>. Explicit formulas for wsize g(P, x) 



can be written in terms of Moore-Penrose pseudoinverses of certain matrices, and are given in |RS08 



Lemma A. 3]. [Theorem 9.3 will give an alternative, related criterion for comparing span programs. 
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2.2 Adversary lower bounds 

There are essentially two techniques, the polynomial and adversary methods, for lower-bounding 
quantum query complexity. The polynomial method was introduced in the quantum setting by 
Beals et al. jBBC"'"Olj . It is based on the observation that after running a quantum algorithm 
for q oracle queries to an input x, the probability of any measurement result is a polynomial of 
degree at most 2q in the variables Xj. The first of the adversary bounds, Adv, was introduced 
by Ambainis |Amb02| . Adversary bounds are a generalization of the classical hybrid argument, 
that considers the entanglement of the system when run on a superposition of input strings. Both 
methods have classical analogs; see [Bci93 and [Aar06j 

The polynomial method and Adv are incomparable. Spalek and Szegedy |SS06] proved the 
equivalence of a number of formulations for the adversary bound Adv, and also showed that Adv is 
subject to a certificate complexity barrier. For example, for / a total boolean function, Adv(/) < 
\/ Co(/)C'i(/)) where Cfe(/) is the best upper bound over those x with /(x) = 6 of the size of the 
smallest certificate for /(x). The polynomial method can surpass this barrier. In particular, for 
the Element Distinctness problem, the polynomial method implies an 0(n^/^) lower bound on the 
quantum query complexity |AS041 lAmbOS) , and this is tight [Amb07| ISze04j . However, displaying 
two list elements that are the same is enough to prove that the list does not have distinct elements, 
so Co(/) = 2 and Adv(/) = 0[^/rl). Adv also suffers a "property testing barrier" on partial 
functions. 

On the other hand, the polynomial method can also be loose. Ambainis gave a total boolean 
function on n = 4^ bits that can be represented exactly by a polynomial of degree only 2^, but 



for which Adv(/'^') = 2.5^^ |Amb06] . and see HLS07 for other examples 



Thus both lower bound methods are limited. In 2007, though, Il0yer et al. discovered a strict 



generalization Adv^ of Adv |IILS07] . For example, for Ambainis's function, Adv^(/'^) > 2.5l'^ 



Adv^ also breaks the certificate complexity and property testing barriers. No similar limits on 
its power have been found. In particular, for no function / is it known that the quantum query 
complexity of / is a'(Adv^(/)). 

In this section, we define the two adversary bounds. On account of how their definitions differ, 
we call Adv the "nonnegative-weight" adversary bound, and Adv^ the "general" adversary bound. 
We also state some previous results. 

Definition 2.4 (Adversary bounds with costs HLSOSl IHLS07] ). For finite sets C and E, and 



D C C", let f : D ^ E and let s G [0, oo)" be a vector of nonnegative costs. An adversary matrix 
for f is a nonzero, {Dl x |D| real, symmetric matrix T that satisfies (x|r|y) = for all x,y £ D 
with /(x) = /(y). 

Define the nonnegative-weight adversary bound for f , with costs s, as 

Adv^(/) = max ||r|| , (2.9) 

adversary matrices F; 
Vx,yeV, (x\r\y)>0 
Vje[n], ||roAj||<Sj 

where T o Aj denotes the entry-wise matrix product between T and Aj = yev-x =/=y \^){y\> "'^'^ 
the norm is the operator norm. 

The general adversary bound for f , with costs s, is 

Adv^(/) = max ||r|| . (2.10) 

adversary matrices V: 
Vj6[n]. l|roAj||<Sj 
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In this maximization, the entries ofT need not be nonnegative. In particular, Adv^(/) > Advs(/). 

Letting 1 = (1,1,..., 1), the nonnegative-weight adversary bound for f is Adv(/) = Advj'(/) 
and the general adversary bound for f is Adv^(/) = Advj (/). 

One special case is when Sj* = for some j* G [n]. In this case, since T o Aj* must be zero, 
letting s' = {si, . . . , Sj^ , . . . , Sn) and fb be the restriction of / to inputs x with Xj* = b, we have 
Advs(/) = maxbgc" Advs/(/6) and Adv^(/) = maxfegc Adv^ (/(,). Provided Sj > for all j G [n], 
we can write 



Adv,(/) 



Adv±(/) 



max 



mm So 



J \\ I 

adversary matrices F: j'Sn ||r o Aj\ 
Vx,y£V, (x\r\y)>0 



max 



mm Sj 



ir o Ai 



(2.11) 



(2.12) 



adversary matrices F j'Gn ^ 

which are the expressions used in Refs. jHLSOS HLS07 . Furthermore, Theorem 6.2 and Theo- 



rem 6.4 will state dual semi-definite programs for Adv and Adv . 



The adversary bounds are primarily of interest because, with uniform costs s = 1, they give 
lower bounds on quantum query complexity. 

Definition 2.5. For f : D ^ E, with D C C", let Qe{f) be the e-bounded- error quantum query 
complexity of f, Q{f) = Qi/io{f), and, when E = {0,1}, let Q^{f) be the one-sided bounded-error 
quantum query complexity. 

Theorem 2.6 ( |BSS03I IhLSOT] ^. For any function f : D ^ E, with D C (7", the e-bounded- error 
quantum query complexity of f is lower-bounded as 



Q.U) > ^-^f^ Adv(/) 



Qe{f) > 



1 - 2^6(1 -e) 



2e 



(2.13) 



Adv±(/) 



In particular, Q{f) = r2(Adv^(/)). Moreover, if D = {0, 1}, then 



(2.14) 



For boolean functions, the nonnegative-weight adversary bound composes multiplicatively, but 



this was not known to hold for the general adversary bound |HLS07 



Theorem 2.7 (Adversary bound composition (HLS071 [SiA06l ILLS061 IHLSOS] ) . Let f : {0, 1}" 

{0, 1} and, for j G [n], let fj : {0, l}™^ ^ {0, 1}. Define g : {0, l}™! x • • • x {0, 1}™" ^ {0, 1} by 

g{x)=f{fi{xi),...,fn{xn)) . (2.15) 
Lets G [0,00)^1 X ••• x [0,oo)™", and let aj = Adv s,{fj) and pj = Adyfifj) for j G [n]. Then 



Adv, (5) = Adv„(/) 
Adv±(5)>Adv±(/) . 



(2.16) 
(2.17) 



In particular, if Adv s^{fi) = ■ ■ ■ = Advs„(/n) = a, then Advs{g) = aAdv(/), and if Advf^{fi] 
■■■ = Adv± (/„) = 13, then Advfig) > /3Adv±(/). 
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Reichardt and Spalek RS08 show that the adversary bounds lower-bound the witness size of 
a span program: 



Theorem 2.8 For any span program P computing fp : {0, 1}"" {0, 1}, 

wsize(P) > Adv=^(/p) > Adv(/p) . 



(2.18) 



There is a direct proof that wsize(P) > Adv(/p) in |RS08( Sec. 5.3], but the inequality 
wsize(P) > Adv^(/p) is only implicit in (RS08 . The argument is as follows. Letting : |0, 1)"'' 



Theorem 1.1 



{0, 1} b e the fc-times- iterated composition of / on itself, Q{fp) = Ofc(wsize(P)'^) by 
Now by [Theorem 2.7[ Adv=^(/)'' < Adv=^(/'') = 0{Q{f^)). Putting these results tog ether and let- 
ting k ^ oo gives Adv^(/) < wsize(P). A full and direct proof will be given below in Theorem 6.1 



Example: Span programs based on one-sided-error quantum 
query algorithms 



Span programs have proved useful in |RS08j for evaluating formulas. There, span programs for 
constant-size gates are composed to generate a span program for a full formula. In this section, 
we give an explicit construction of asymptotically large span programs that are interesting from 
the perspective of quantum algorithms and that do not arise from the composition of constant-size 
span programs. We relate span program witness size to one-sided bounded-error quantum query 
complexity. [Theorem 7.1 below will strengthen the results in this section, but the construction 
there will be less explicit. 
Formally, we show: 

Theorem 3.1. Consider a quantum query algorithm A that evaluates f : {0,1}" — > {0,1}, with 
bounded one-sided error on false inputs, using q queries. Then there exists a span program P 
computing fp = f , with 

wsize(P) = 0{q) . (3.1) 
In particular, infp.jp=j wsize(P) = 0{Q^{f)). 



This example should be illustrative for [Definition 2.1 and Definition 2.3 but is not needed for 



the rest of this article. Another nontrivial span program example is given in Appendix A 



Many known quantum query algorithms have one-sided error, as required by Theorem 3.1 
or can be trivially modified to have one-sided error. Examples include algorithms for Search, 
Ordered Search, Graph Collision, Triangle Finding, and Element Distinctness. There are excep- 
tions, though. For example, the formula-evaluation algorithms discussed above and implicit in 

In particular, for AND-OR formula evaluation. 



Theorem 1.1 all have bounded two-sided error. 



the algorithm from |ACR"'"07j outputs the formula's evaluation but not a witness to that evalua- 
tion [RSOSj Sec. 5]. For AND-OR formula evaluation, a witness can be extracted from the A = 
graph eigenstate, but it is not known how far this generalizes |ACGT09] . We certainly expect that 
there are functions / with bounded two-sided-error quantum query complexity, Q{f), strictly less 
than the bounded one-sided-error quantum query complexity, Q^{f). 



Proof of \Theorem 3.1 Assume that the quantum algorithm A has a workspace of m qubits, and an 
n-dimensional query register. Starting in the state |0™, 1), it alternates between applying unitaries 
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independent of the input string x and oracle queries to x. The evolution of the system is given by 

\m) = E •=! M\3) - \^2) = - • • • 

^2r-l) = Ej=l \^2r-l,j)\j) ^ \^2r) = T.'j=l{-'^T' \^2r-l,j)\j) 
\'P2q+l) 

(3.2) 

Here, for r G [g + 1], V2r-i is the unitary independent of x that is applied at odd time step 2r — 1, 
while Ox '■ \y)\j) ^ is the phase-flip input oracle applied at even time steps. (To allow 

conditional queries, prepend a constant bit to the input string x.) The state of the system after 
s time steps is \ipr) = Yl]=i \Vs,j) •X' for s > 2, these states depend on x. 

On inputs x evaluating to f{x) = 1, the algorithm A does not make errors. Thus for these 
x we may assume without loss of generality that \ip2q+i) = lO™", 1), by at most doubling the 
number of queries to clean the algorithm's workspace. On inputs evaluating to f{x) = 0, then, 
1(0"*, l|992(j+i)| < e for some e bounded away from one. 

Recall that B = {0, 1}. We construct a span program P as follows: 

• The inner product space is F = C'^^^'*"^^^'", spanned by the orthonormal basis {\s,y, j) : s E 
{0,l,...,2g+l},yGS-,iG [n]}. 

• The target vector is |i) = -|0, 0"*, 1) + |2(? + 1, 0™, 1). 

• There are free input vectors for each odd time step s: /free = {2r — 1 : r G 1]} x x [n], 
with 

\'"s,y,j) = + \s)<^Vs\y,j) (3.3) 

for (s,y,j) G /free- 

• For j G [n] and b e B, Ij^i, = {2r : r £ [q]} x 5™ x [n] x {b}, with, for (s, y,j, b) G Ij^b, 

Ky,j,b) = -i\s - 1) + (-l)''!^)) ® \y,j) . (3.4) 



ko) = |0™,l) 



V2r-1 
V2q+1 



For analyzing this span program, it will be helpful to set up some additional notation. Let Ug 
be the unitary applied at time step s: 

V, if s is odd 

n -f ■ (^-^^ 

(Jx II s IS even 

For an input x, the available input vectors, i.e., those indexed by I{x), are then 

\vs,y,j) ■= -\s,y,j) + |s + 1) (g) Us+i\y,j) (3.6) 

for all y G B"^, j G [n] and s = 0, 1, . . . , 2g even or odd. Let A{x) = Yll=o ^y j \'^s,y,j){s, y,j\- Then 
fp{x) = 1 if and only if |t) G Range(A(x)). 

Claim 3.2. // f{x) = 1, then fp{x) = 1 and wsize(P, x) < q. 
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Proof. Letting \w) = Yl1=o ® \ fs), then 

2q 

A{x)\w) =^^\Vs,y,j){y,j\Vs) 
s=0 y,j 
2g 

= J2 -|«) ^ I'Ps) + |s + 1) <8) Us+i\(ps) 

^=0 (3.7) 

2q 

= Yl ^ 1*^*) + |S + 1) (g) \(Ps+l) 

s=0 

= -|0) ® \(po) + \2q + 1) ® \(p2q+l) 

= \t) , 

where we have used for the second equahty that j \y,j){y,j\ is a resolution of the identity, and 
for the third equality that Us+i\(ps) = \fs+i) in order to get a telescoping series. Thus \w) is a 
witness to fp{x) = 1. Since the input vectors \vs,y,j) for s even are free, the witness size is 

2 



wsize(P, x) < 



^|2A;+1)(2A;+1|®1 

.k=l J 
|2 



\W) 



(3.8) 



= ^|||2A;+l)®|<^2fe+i)ir 

= q . □ 
Claim 3.3. // f{x) = 0, then fp{x) = and wsize(P, x) < 4g/(l - e)^. 

Proof. Let = J^^lV \s)<^\(ps). Then \{t\w')\ = |1 - (0"", l|(^2q+i)| > 1-e > 0. Moreover, since 

'-{y,j\Vs) ifc7 = S 

{y,j\ul^-^\(fs+i) = (yJlfs) if cr = s + 1 (3.9) 
otherwise 



{Vs,y,j\{W) ^\'Pa))= { 

we compute 



2q 2q+l 

A{x)^w') = E E E l«'2/'i)K2/jKI^) ® 1^-)) = • (3-10) 

s=0 (7=0 y,j 

Thus \w') is a witness to fp{x) = 0. Now the input vectors associated with false inputs are, for 
odd s between 1 and 2g — 1, y G {0, 1}"* and j G [n], It's j) '■= —\s,y,j) — \s + 1) Us+i\y,j). Now 

{v's^yjw') = -{y,j\<Ps) - {y,j\ul^i\(ps+i) = -2{y,j\(ps). The witness size therefore satisfies 

(1 - 6)2wsize(P,a;) < ^ E l<^2fe-i,,,>')l' (3.11) 

k=l y,j 

= 4EEl(2/'^1</^2fe+i)|' 

k=l y,j 

= 4g . □ 
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After scaling the target vector appropriately — see Eq. (2.8) — Claim 3.2 and Claim 3.3 together 
give wsize(P) < 2g/(l — e), proving Theorem 3.1 □ 



4 Span program manipulations 

This section presents several useful manipulations of span programs. First, we develop span pro- 
gram complementati on a nd composition. The essential ideas for both manipulations have already 
been proposed in [RSOSj . but the ideas there were not fully translated into the span program 



formalism, which we do here. Section 4.2 also introduces a new construction of composed span pro- 
grams, tensor-product composition, which appears be useful for designing more efficient quantum 
algorithms for evaluating formulas [ReiOO] . 

Both techniques take as inputs span programs computing certain functions and output a span 



program computing a different function. In Section 4.3 we give two ways of simplifying a span 



program P that do not change fp nor increase the witness size. Section 5] will present a more 
dramatic simplification, though. 



4.1 Span program complementation 



Although Definition 2.1 seems to have asymmetrical conditions conditions for when fp{x) = 1 
versus when fp{x) = 0, this is misleading. In fact, span programs can be complemented freely. 
This is important for composing span programs that compute non- monotone functions. 

Lemma 4.1. For every span program P, there exists a span program P^, said to he "dual" to P, 
that computes the negation of fp, fpt{x) = -^fp{x), with witness size wsizes(P^^, x) = wsizes(-P, 
for all X G B"- and s G [0, oo)". 



Proof. There are different constructions of dual span programs |CF02| INNP051 IRS08 . Here we 
more or less follow [RSOB, Sec. 2.3], as the other constructions may not preserve witness size. 

As in Definition 2.1[ let P have target vector \t) and input vectors \vi), for i ^ I = /free U 



Uje[n] bs-B -^i-^' ™ inner product space V = C . Recall that A = X^jg/ |t'i)(i|, I{x) = 



U 



;j6[„] ^i,x, and Ii{x) = E*e/(x) 



Let n(x) = NX^I) and fix an orthonormal basis 



{\k):k& [d]} for V. 

Definition 4.2. The dual span program P'^ , with target vector \t') and input vectors for k G 
/' = U Uje[n] beB b inner product space V , is defined by: 

• V' = C^+l-'^l, with orthonormal basis {|0)} U : i G /}. 

• \t') = \o). 

• = [d] , with free input vectors, for k G If^^g, 



\v',) = mt\+A^)\k) = \o)m + ^\i){v. 



(4.1) 



• For j G [n] and b ^ B, I'-^^ = Ij i with \v'j) = \i) for i G Ij ^. 
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Fix s G [0, oo)-, and let A' = ^.^j, \vi){k\ = \0){t\ + + E^e/./,.,. KX^I- Let I'{x) = U 
UjeN ^,x, and n'(x) = Y.iei'{x) NX^I- 

If fp{x) = 1, then there exists a witness \w) G C'^' s uch that AIl{x )\w) = \t). Assume that \w) 
is an optimal witness, i.e., wsizes(P, j;) = (see Definition 2.3). Let \w') = |0) — Ii{x)\w). 

Then {t'\w') = 1 and 



j^^\n,') = (\tm+A+ K)(i|)(|o)-n(x)H) 

= \t)-AIl{x)\w)- \i)m{x)H (42) 

= -(i- Y NX^l)n(x)l^> • 



Therefore, is orthogonal to the available inp ut vect ors of {II' (x) A'^w') = 0), implying that 
\w') is a witness to fpt{x) = 0. Moreover, Eq. (4.2) also implies wsizes(P, x) = ||S'A'"l'|tt;') || > 
wsizes(P^^, x). 

Conversely, if fpt{x) = 0, then there is a witness \w') G V, with {t'lw') = 1, orthogonal to 
the available input vectors of . Assume that \w') is an optimal witness, i.e., wsizes(P^,x) = 
||5'74'"'^|w') Ip. The two conditions {0\w') = 1, and {i\w') = for all i G Uj^[n]Ij,Xj, imply (1 — 
Il{x))\w') = |0). The condition that \w') is orthogonal to the free input vectors then implies 

= {\m + A)\w') 

= (|t)(0|+^)(|0)+n(x)|u;')) (4.3) 
= \t) + AU{x)\w') . 

Thus fp{x) = 1, with witness \w) = —Il{x)\w') . Moreover, the equalities of Eq. [("4.2) still hold, so 
wsizes(P'l", x) = ||S'n(x)|i(;)||^ > wsizes(P, x). 

So far we have shown that /pt(x) = ~'/p(x) for all x G P". It remains to show that 
wsizes(P, x) = wsizes(P^,x) in the case fp{x) = 0. 

Assume that fp{x) = 0. Then there exists an optimal witness \w') satisfying {t\w') = 1, 
n{x)A^\w') = and wsize,(P,x) = USAtju-Of • Let \w) = \w') - (1 - n{x))A^\w') . Then \w) is 
supported only on the available input vector indices of P'^\ the first term, is supported on 

-^free' while the second term is supported only on Ujg[„]/ji^. . Furthermore, 

A'\w) = {\m+A^ + Yl Nx^i)(i^')-(i-n(x))^t|^')) 

= {\o){t\ + A^)\w') - ( Y m-n(x))^t|^') 
= |o) = \t') 

since X^jg/^/^ KX^I ~ n(a^) = 1 — n(x). Therefore \w) is a witness to fpi{x) = 0. Moreover, the 
squared length of S[l — X^^-g/ 
so wsizes(P^,x) < wsizes(P, x) 



(4.4) 



squared length of S{l - Y.k(^r is \\S{1 -Ii{x))A^\w')f = \\SA'^\w')f = wsize,(P,x), 
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To show the converse statement, wsizes{P,x) < wsizes(-P^, x), let Hr = Xlfcp/' I^X^I be 

free 

the projection onto the free columns of A'. Let \w) be an optimal witness to fp]{x) = 1, i.e., 



wsize5(Pt,x) = \\S{1 - Kee)\^)f- Then Ii'{x)\w) = (n'^^,, + E.6/'(.).4^^ = \w) and 

= |0) = A!\w) 



(4.5) 



This implies that (t|n£j,gj,|t(;) = 1 and also j4"'TIf^gg|tt;) + Ylj&ni&ij s,. KX^I^) = Multiplying by 
n(x), the latter equation implies that n(x)^^^n[j.gg|i(;) 



0, so \w') = Il[j.^Jw) is a witness for 



fp{x) = 0. Therefore, 



wsize,(P,x) < \\SA^\w')\\ 

s KX^k) 
||5(i-nUl^>f 

wsizes(P^, x) . 



(4.6) 



□ 



Thus wsizes(P^,x) = wsizes(-P, x) always. 
4.2 Tensor-product and direct-sum span program composition 

We will now show that the best span program witness size for a function composes sub-multiplicatively, 
in the following sense: 

Theorem 4.3 (Span program composition). Consider functions f : B and, for j G [n], 

fj ■.B'^^B. Letg-.B'^^B he defined by 



g{x) = f{fi{x), f2{x), . . . , fn{x)) 



(4.7) 



Let P be a span program computing fp = f and, for j £ [n], let Pj be a span program computing 
fPj = fj- 

Then there exists a span program Q computing fq = g, and such that, for any s S [0, co)™ and 



WS\ZQs{Pj), 



wsizes((5) < wsizer.(-P) 
In particular, wsizes((5) < wsize(P) maxjg[„] wsizes(Pj). 



(4.^ 



The ease with which span programs compose is one of their nicest features. To prove Theo- 



rem 4.3 we will give two constructions of composed span programs, a tensor-product-composed 



span program and a direct-sum-composed span program Q®, that each satisfy Eq. (4.8) The 
method of composing span programs used in RSOS] is a special case of direct-sum composition. 



but tensor-product composition is new. Below the proof of Theorem 4.3 we will define a third 



composition method, reduced-tensor-product span program composition, that is closely related to 
tensor-product composition. 
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Of course, only one proof of Theorem 4.3 is needed, so the definitions and proofs for Q® 
and Q*"® can be safely skipped over. We include here multiple composition methods because 
the different constructions have different tradeoffs when it comes to designing efficient quantum 
algorithms for formula evaluation. In particular, we believe that an intermediate construction, in 
which some inputs are composed in a reduced-tensor-product fashion and other inputs in the direct- 
sum fashion, should be useful for designing a slightly faster quantum algorithm for evaluating AND- 



OR formulas jRei09| . Appendix B gives examples of the three different span program composition 



methods for AND-OR formulas, using the correspondence between span programs and bipartite 



graphs that will be developed in Section 8 



Proof of Theorem 4-3 Let span program P be in inner-product space V, with target vector \t) and 
input vectors indexed by /free and Ijc for j £ [n] and c £ B. For j £ [n], let P^^ = Pj and let P^^ 
be a span program computing fpjo = -'fpji with wsi7,es{P-'^) = wsizes{P-'^). Such span programs 



exist by Lemma 4.1 For j G [n] and c £ B, let P^^ be in the inner product space V^^ with target 
vector IP*^) and input vectors indexed by /j^^g and I^^ for k £ [m], b £ B. 

Some more notation will be convenient. For x £ B"^, let y = y{x) £ B"" be given by y{x)j = 
fpji{x) = fj{x) for j £ [n]. Thus g{x) = f{y{x)). Also let I{y)' = I{y) \ /free = ^j(i[n]Ijyj- Define 
: I \ /free [n\ y~ B by = (j, c) if z G Ijc- The idea is that maps i to the index of the span 
program that must evaluate to true in order for \vi) to be available. 

Definition 4.4. The tensor-product-composed span program Q® is defined by: 

• The inner product space is = V (S)je[n] ceB 

• The target vector is \t®) = \t)y (g) <S>jeln].ceB 

• The free input vectors are indexed by If® ^ = /free U Uje[n],ceB(^ic x /free) f'^^ ^ ^ ^bee' 

[n],c(^B if i ^ Ifree 

'^^ ^ " I \vi')v ® \vi")vj- ® <^j'e[n],c'eB: \t^'''')v^'-' if i = (^'' i") e Ijc X //4 (^-^^ 

I {j',c')^{j,c) 

• The other input vectors are indexed by /^ = \Jj(z[n],c&B{Ijc x lit) fof k £ [m], b £ B. For 
i £ Ijc, i' £ III, let 



\vt^ = \vi)y®\vii)y,.® 09 . (4.10) 

j'eH.c'e-B: 
(i',c')7^(i,c) 

Definition 4.5. The direct-sum-composed span program Q® is defined by: 

• The inner product space is V® = V (B ©je[n] ceBi^^^" ^ V^'^). Any vector in V® can be 
uniquely expressed as \u)y -\- X]ie/\/frcc ® 1^*^' where \u) £ V and \ui) £ V^W. 

• The target vector is \t®) = 
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The free input vectors are indexed by I^^^ = / U Uje[n],c€B(^jc x -^free) f'^^ ^ ^ -^free' 



Vi)y ifielfr, 



(4.11) 



\i')'^\vi") ifi = {i',i")eljcxll 



free 



The other input vectors are indexed by = Ujg[„] ^.^^(/jc x I^j^) for k S [m], h ^ B. For 
i e Ijc, i' G III, let 



\vl,) = \^®\v^') ■ 

For X £ B^, the indices of the available input vectors for Q® and Q® are 

je[n],ceB 

/®(x) = /U J IjcXp^ix) . 

je[n],ceB 



(4.12) 

(4.13) 
(4.14) 



Note that if /free = /free ~ ^o^' J ^ ^^"^ c £ B, then Q*® has no free input vectors either, 



free 



Assume g{x) = fp{y{x)) = 1. Then we have witnesses \w) G and \w^y^) G C^^^^ , for j G [n], 
such that 



ie/(y) 
ie/-''^j (x) 

and such that wsizer.(P, y) = HiJlfi;)!!^ (where, analogous to the definition of 5* in 
R = EieH,ceB,e/,. ^A^KX^I) and wsize,(P^%- , x) = \\S\w^y^)r. 
Let \w®) G C^''^^) be 



(4.15) 



Definition 2.3 



wY = < 



Then 

E ^ 

ie/®(x) 



U;, if i G /free 

lOi'w;^/;'^ if i = {i', i") with i' G /(y)', i" G I«(^')(x) 
otherwise 



i&I{y) je[n],ceB 

, (4.17) 



(4.16) 



so indeed fQ<s{x) = 1. 
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Let \w®) G C^®W be 



Wi'W, 





if i = {i', i") with i' G 7(y)', G 



if i G I{y) 



(4.18) 



otherwise 



Then 



^ wf\vf)= ^Wi\vi)y+ Mh)v-\i)^\*'^'^))+ Yl Wiwlr'\i)^\vi') 

ie/®(a;) ie/free 16/(2/)' *ei'(2/)', 

iei"(2/) 16/(2/)' i'e-f'^W(x) 

= = , (4.19) 



so indeed fQ®{x) = 1. 
Moreover, 



Sk\wiw; 



yyj\2 



wsizes(P'^^*\x)|i/;i 

je-f(2/)' 

wsizer(P,y) , 



(4.20) 



so wsize5(Q®,x) = wsizes((5®, x) < wsizer.(P, y). 

Now assume that g{x) = fp{y) = 0. Then we have witnesses |u) G V and \u^yi) G y-'^^, for 
j G [n], such that {t\u) = (t^'^^ ju-'* ) = 1, (viju) = for i G I{y), {vi\u^y^) = for i G /^(x), 
wsizer(P,y) = Y.je{n],ieijy. ^iK^il")l^ and wsize, (PW , a;) = E^^r , .^^^s, Sfc|(wj|MJ'^i)|2. 

Let 



(4.21) 



Then (t®|n®) = 1. For i G /free; (^f'l'^''^) = since {vi\u) = 0, and similarly for i G Ijy-, 

i' G im[x), {v®i,\u®) = 0. We also have that for j G [n], z G /j^^. and i' G P^i(x), = 0, 

since {vii\u^y^) = 0. Thus {vf\u®) = for all i G /^(a;), so \u^) is a witness for fg^ix) = 0. 
Moreover, 



wsize,(Q®,x)< ^ 



(4.22) 



j(^[n],i&Ijy., 
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where we have used = for i G I{y), since {vi\u) = 0, 



ie/\/(j/), 



(Uily (g) {Vi'\y,(i) 



je[n],c6B: 
0-,c)7^c(i) 



j£[n] \ 



\\\tm)\\^^ 



= Yl Sk\{vi\n)\'-\{vi'\n'^'^)f 



iel^l{y), 



= Yl wsize3(P««,x)|(^;i|ii)r 
iel\l{y) 

= wsizer {P,y) , 



(4.23) 



where we have substituted the definitions of and \u'^), and used {py^lu^^^} = 1. We conclude 
that /q® = 5 and wsizes{Q'^) < wsizer(P). 
Let 

\u®) = \u)y+ Y {vi\u)\i)^\ui) . (4.24) 

Then {t®\u®) = 1. For i G /j®^, (t>f|n®) = 0. Indeed, this follows for i G I{y) since {vi\u) = 0, 
and it holds for z G J \ I{y) since {{vi\y — (i| ® |)(|^i)y + ('i'jl'w)K) ® = 0. is clearly 
orthogonal to the entire subspace \i) ® F^*^'^ for i G I{y)- Finally, for i e / \ I{y) and i' G 7'^^*)(x), 
(ti®,|u®) = since {vii\ui) = 0. Thus ('u®|u®) = for all i G I®{x), so l^x®) is a witness for 
/ge (x) = 0. Moreover, 



u 



wsizes(Q®,x) < Y ^k\{v% 
ie/\7(2/) 

= Y Sk\{vi\u)f\{Vi>\Ui)f 

= J2 wsize,(P^«,x)|(i;i|u)|2 

jG/\/{?/) 

= wsizer(P, y) . 
We conclude that fg® = g and wsizes((5®) < wsizer(P). 



(4.25) 

□ 



Tensor-product composition is somewhat extravagant in the dimension of the final inner product 
space. This is not a particular concern theoretically, since a set of m vectors can always be embedded 
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isometrically in at most m dimensions. However, it can be convenient to have an explicit isometric 
embedding of the composed span program's vectors into a lower dimensional space. The "reduced" 
tensor-product span program composition, which we will define next, is such an embedding. It 
is particularly effective when the outer span program has many zero entries in its input vectors. 
Canonical span programs, defined below in Section 5| are good examples. 

As in the setup for Theorem 4.3 consider functions / : B and, for /c E [n], : B'^ B. 

Let g-.B"" ^ B be defined by 

g{x) = f{h{x),f2{x),...,Ux)) . (4.26) 

Let P be a span program computing fp = f and, for j £ [n], let Pj be a span program computing 
fPj = fj- 

Let span program P be in inner-product space V, with target vector \t) and input vectors 
indexed by /free and Ijc for j G [n] and c £ B. For j G [n], let P^^ = Pj and let P^^ be a span 
program computing fpjo = ~'/pji with wsizes(P-''^) = wsizes(P-'^). For j £ [n] and c £ B, let P^'^ 
be in the inner product space V^^ with target vector \t^^) and input vectors indexed by /j?,^^ and 
III for k £ [m], b£ B. 

Let d = dim(V^) and {|/) : / G [d]} be an orthonormal basis for V. 

Definition 4.6. The tensor-product- composed span program, reduced with respect to the basis {\l) : 
I £ [d]}, is Q"^®, defined by: 

• Forl£ [d], let Zi = {(j,c) e [n] x S : Vi G Ijc. {l\vi) = 0}, and let n = W{j^c)^Zi 

• The inner product space of Q^® is V^® = ©/gj^^] ^ ®{jc)<^Zi vector \v) £ can 
be uniquely expressed as J2ie[d] 10 bi); where \vi) £ 'S){jc)<fZi 

• The target vector is 

\f^) = Y,m\i)^i® (g) \tnv^^ ■ (4-27) 

• The free input vectors are indexed by I^®^ = I^^^ = /free U Uje[n],ceBi^jc x -^free) /^'^ 

i £ r® 

* -'free' 

^ " I J2le[d] ® \Vi")vjc (g) {j',c')^Zi: \i^'^')vJ'-' ^ = (^''^") ^ X 4ee 

(4.28) 

• The other input vectors are indexed by = = Ujg[„] ^^^(-^jc x lH) for k £ [m], b £ B. 
For i £ Ijc, i' £ I^, let 



For example, if P is a canonical span program — see Definition 5.1 below — with {\x) : x £ 
B"', fp{x) = 0} an orthonormal basis for V , then for each x with fp{x) = 0, {{j, Xj) : J G [ra]} C Z^- 
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Proposition 4.7. The span program Q^® computes fqr® = g, and, for any s G [0, cxd)™', 

wsize,(Q''®) < wsize^(P) , (4.30) 
where Gj = wsizes(Pj) for j £ [n]. In particular, wsizeg^Q^'^) < wsize(P) maxjg[„] wsizes(Pj). 



Proof. Rather than repeat the proof of Theorem 4.3 it is enough to note that the input vectors of 
Q^^ are in one-to-one correspondence with the input vectors of Q®, and that the lengths of, and 
angles between, corresponding vectors are preserved. Therefore, /gr® = /g® and for all s G [0, cxd)" 
and X £ B"-, wsizes(Q''® , x) = wsizes(Q®, rr). □ 

To conclude this section, let us remark that the composed span programs Q®, and Q^'® 
from [Theorem 4^3 and Definition 4.6 are optimal under certain conditions. 



Corollary 4.8. In Theorem 4-3 assume that the functions fj, j G [n], depend on disjoint sets of the 
input bits. Assume also that the span programs Pj have wit ness sizes rj = wsizes{Pj) = Adv^(/j) 
and that P has witness size wsizer(P) = Adv^(/). (By Theorem 2.8, these witness sizes are 



optimal.) Then the composed span program Q satisfies 

wsize,(Q) = Adyfig) = Adv±(/) , 

which is optimal. 

Proof. We have the inequalities 

Adv±(/)<Adv±(5) 

< wsizes{Q) 

< wsizer(P) 
= Adv±(/) , 



(4.31) 



(4.32) 



where the three inequalities are from Theorem 2.7[ [Theorem 2.8 and Theorem 4.3 respectively. 
Therefore, all inequalities are equalities, and Eq. (4.31) follows. □ 



Theorem 6.1 below will show that a span program P has optimal witness size with costs s among 
all span programs computing fp if and only if wsizes(P) = Adv^(/p). Therefore, Corollary 4.8 



says that Q is optimal if the input span programs are optimal and the fj depend on disjoint sets 
of the input bits. 

4.3 Strict and real span programs 



For searching for span programs with optimal witness size, it turns out that Definition 2.1 is more 
general than necessary. In fact, it suffices to consider span programs over the reals R, and without 
any free input vectors. 

Definition 4.9. Let P be a span program. 

• P is strict if it has no free input vectors, i.e., /free = 0- 

• P is real if in a basis for V the coefficients of the input and target vectors are all real numbers. 
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P is monotone if Ijfi = for all j G [n] . 



As remarked in Section 2.1 [ KW93] considered only strict span programs. 

Proposition 4.10. For any span program P, there exists a strict span program P' with fpi = fp 
and wsizes(-P', x) = wsizes(P, x) for all s G [0, oo)" and x £ B" . 

Proof. Construct P' by projecting P's target vector \t) and input vectors {\vi) : i G / \ /free} to 
the space orthogonal to the span of the free input vectors. That is, let Afree be the projection onto 
the space orthogonal to Span({|fj) : i £ /free})- Then the target vector of P' is Afree|t) and the 
input vectors are {Afree : « G / \ /free}- 

Then fpi = fp. Indeed, if fp{x) = 1, i.e., \t) = AIl{x)\w) for some witness \w), then \w) is also 
a witness for fp'{x) = 1. Conversely, if fpi{x) = 1, i.e., for some \w), Afree|t) = Afree^n(x)|tt;), 
then \t) - An{x)\w) G Range({|7;i) : i G /free}), so fp{x) = 1. 

Now fix s G [0, oo)". We claim that wsizes(/", x) = wsizes(P, x) for all x G /?". 



First, if fp{x) = 0, then by Definition 2.3 



wsize^fP, x) = min H^A^Iw')!!^ 

\w'):{t\w') = l 

n(x)At|u.'>=o 



= min \\SA^\w')r 

\w'):{t\w') = l 

U(x)A^\w')=o C4 33^ 

min \\SA^Afrcc\w')\f 

\w'):{t\Ai,,,\w') = l 
n(x)AtAfr,,|«;'>=0 

= wsizes{P', x) , 

where the second equality is because n(a;)A"f|u;') = implies in particular that {vi\w') = for all 

^ £ /free- 

If fp{x) = 1, then let Hfree = Eie/tac I^X^I n'(^) = n(^) ~ ^fr^^*^ = Eie/(x)\/frec I^X^I- 



have 



wsizes(P,x) = min USTl'fxlltf;) 11^ 

\w):AU(x)\w)=\t) 

min \\S\w)f (4.34) 

|io>:n'(a;)|«;>=|u;> 
A|«>>-|t>eRange(yinf,ec) 

= _ min _ ||S'|u;)|p 

|i«>:Afrco^n'(x)|«;)=Af,eo|t> 

= wsizes(/'', x) . □ 
Span programs may also be taken to be real without harming the witness size: 

Lemma 4.11. For any span program P, there exists a real span program P' computing the same 
function fpi = fp, with wsizes(P',x) < wsizes(P, x) for every cost vector s G [0, cxd)" and x G /?". 

Proof. Let i = \/— 1. For a complex number c G C, let 3^(c), 9(c) G R denote its real and imaginary 
parts, c = 5R(c) + 9(c)«. Extend this definition entry- wise to complex vectors: for w G C', let 
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^{v) = {^{vi), ^{vi)) and Q{v) = . . . , 9(^0). Furthermore, define : ^ R' 

by 

R{v) = ^{v) ^ \0) + Q{v) ^ \1) . (4.35) 
Note that this map satisfies, for any vector v G and any scalar c G C, ||i?(f)|| = \\v\\ and 

R{cv) = ^{c)R{v) + Q{c)R{iv) . (4.36) 

Let P have target vector \t), and input vectors \v^) for i G / = /free U Uje[n] beB^j,b- Fix an 
arbitrary orthonormal basis for P's inner product space V. 

Let the inner product space for P' he V' = V ® C^. Let P"s target vector be \t') = R{\t)), and 
its input vectors be indexed by /' = I x B, such that for any x G /?", the set of available input 
vectors is indexed by I'{x) = I{x) x B. That is, I'^^^^ = /free x B and I'- ^ = /j^f, x B for j G [n] and 
b £ B. For (i, b) £ I' = I x B, let the corresponding input vector be 

I \ pr^i \^ jmv.))^\O) + Q{\v,))0\l) if 6 = 

Uife) = it(« \vA) = < (4.37) 

' " \-'^{\v,))0\O)+^{\v,))0\l) iib = l ^ ' 

Fix a cost vector s G [0,cxd)". Let A = ^' = bt.foX^i ^1 and n(x) = 

The most interesting case to check is when fp'{x) = 0. Let \w') be an optimal witness, i.e., 
{w'\t') = 1, {U{x)(g)l)A'^w') = and wsizes{P',x) = ||(n(x) l)A't|?i;') p. Then since the entries 
of P"s target and input vectors are real, ?li{\w')) is also a witness for fp'{x) = 0, with equal or 
better witness size, so assume that \w') = ?lt{\w')). Let {w) be such that R{\w)) = \w'). Then 
^{{w\t)) = {w'\t') = 1 so Kf^lt)! > 1; there may be a nonzero imaginary part to {w\t). Also, 
A'^\w') = R{A^\w)), so \w) is a witness for fp{x) = and \\{S l)A'^\w')f = \\SA^\w)\\'^. Hence 
wsizes(P, x) < wsizes{P' , x) /\{'w\t) \ < wsizes(P', x). 

The arguments in the other cases are similar. In every case, witnesses for P and for P' have a 
simple correspondence. If \w) is a witness for fp{x) = b £ B, then \w') = R{\w)) will be a witness 
for fp'{x) = b. If \w') is a witness for fp'{x) = b, then so is ^{\w')), and letting \w) be such that 
/i(|^«)) = 5R(|ri;')), will be a witness for fp{x) = b. We omit the details. □ 



[Lemma 4.11 implies that there would have been no loss in generality in defining span programs 



over R instead of over C. In some cases, though, it is convenient to work over C to have smaller 



span programs. For example, |RS08j gives a span program for the three-majority function with 
three input vectors and optimal witness size two, and one can verify that this is impossible for span 
programs over R. 



The idea of the construction in Lemma 4.11 is essentially to replace every entry a of A 



Yliei l^iX^I by the 2x2 block (^^ ~s^a) simulate multiplication of complex numbers over the 
reals. The proof can be slightly simplified by assuming, without loss of generality, that \t) = |1), 
a basis vector for V. We have avoided doing so, though, in order to illustrate a special case of 



how span programs can be defined over matrices. For j, /c, / G N, Definition 2.1 and Definition 2.3 
naturally extend to allowing the target to be a vector oi j x I matrices and the input vectors to 
have entries that are j x k matrices. The program evaluates to 1 if there exists a way of summing 
available input vectors multiplied hy k x I matrices to reach the target. Provided that an entry- 



wise matrix inner product is used in the generalization of Definition 2.3 such programs can be 



simulated over R without changing the witness size. This generalization can be useful for finding 
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span programs when we would like to work with a higher-dimensional representation of a function's 
symmetry group. For example, this tech nique h as been used to find an optimal span program for 
a Hamming- weight threshold function in RSOS) Example 5.1]. 

Let us conclude this section with one last span program manipulation: 

Lemma 4.12. For P a span program and M any invertihle linear transformation on P's inner 
product space V, fp and the witness size of P are invariant under applying M to the target vector 
and all input vectors. 

Proof. Let P' be the span program in which M has been applied to P's target and input vectors. 
The claim is that for all x G i?" and s G [0,oo)"', fp'{x) = fp{x) and wsizes(P, x) = wsizes(P', x). 
Indeed, the conditions AIl{x)\w) = \t) and {MA)Il{x)\w) = M\t) are equivalent. This implies that 
fp = fp' and, when fp{x) = 1, wsizes(P, x) = wsizes(P', x), by definition Eq. |(2.5) To finish the 
proof, note that when fp{x) = 0, 



mm 

\u,'):(t\w') = l 
U(x)A^w')=0 



\\SA^\ 



w 



mm 

\w'):{t\M^w') = 
n(x)(MA)t|«,') = 



||5(AM)t|u;')|p 



(4.38) 



by the change of variables \w') M'^\w'). By Eq. (2.6), wsizes(P, x) = wsizes(P', x). 



□ 



5 Canonical span programs 



For every function / : P" B, there exists a span program P computing fp = f. Indeed, one 
can, for example, expand / into a circuit that uses OR gates and NOT gates. Each OR gate can 
be implemented by a trivial span program with \t) = \vi) = (1) £ C. Appealing to Lemma 4.1 
to negate this span program, and using Theorem 4.3| to compose the span programs following the 
circuit, gives a span program for /. However, this naive span program will generally not have 
the optimal witness size among all span programs computing /. Moreover, there is considerable 
freedom in the definition of span programs, so unless / is very simple, it can be quite difficult to 
find an optimal span program. 

In this section we prove that it suffices to search over span programs with a restricted form. 



so-called canonical span programs. Combined with Lemma 4.11 this implies that it suffices to look 



for real, canonical span programs. In Section 6 we will develop a semi-definite program, inspired by 
this reduction, for computing the optimal span program for a function. Canonical span programs 
were originally defined by Karchmer and Wigderson |KW93j . but their significance for developing 
quantum algorithms was not at first appreciated. 

Definition 5.1 (Canonical span program |KW93j ) . Let P be a span program computing fp : P" 



B, with inner product space V, target vector \t) and input vectors \vi) for i G /fr, 
P is canonical if: 



uU 



je[n],beB ^j,b- 



-ffrcc = 0- Thus P is strict (Definition 4-9}. 



V = C^o ^here Fq = {x e P" : /p(x) = 0}. 

In the orthonormal basis {\x) : x G Fq} for V, the target \t) is given by \t) = YlxeFo 1^)' ^^'^ 
For all X G Fq, j £ [n] and i £ Ij,Xj, {x\vi) = 0. 
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Theorem 5.2. For any cost vector s G [0, oo)"^, a span program P can be converted to a canonical 
span program P that computes the same function fp = fp, with wsize<j(P, x) < wsizes(-P, x) for 
all X G B". In fact, for all x G with fp{x) = 0, wsizes(P, x) = wsizes(P, x), with \x) itself an 
optimal witness for fp{x) = 0. 

Moreover, P uses the same input vector index sets Ij^h <is P, so in particular if P is monotone 
then P is also monotone. If P is real, then so is P. 

Proof. This theorem is analogous to jKW931 Theorem 6], and we use the same conversion procedure, 
except we additionally analyze the witness size. 

Let P have target vector |t) G V and input vectors \vi) for i G / = /free U Uje[n] beB ^j,b- Recall 
the definitions A = Yli&i l^iX^I) = hree U UjeN ^h^j ^(x) = Yliaiix) NX^I- ^ ^ [0' oo)"" 
and let S = Eje[n],beB,iei,.t V^KX^I- 

For X G -B", let \vu{x)) or \w'{x)) be optimal witnesses for fp{x) being 1 or 0, respectively, with 
costs s. That is, let 

\w{x)) = argmin|^)^^n(x)|«,>=|t>ll'S'|ii')f if fp{x) = 1 

\w\x)) = aigmiu\^,),(j-\^ts^^-^\\SA^\w')f if /p(x) = ^^'^^ 
n(x)At|w')=o 

(See (RS08| Lemma A. 3] for explicit formulas for \w{x)) and |?i;'(x)).) 

Let Fq = {x G -B" : fp{x) =0}. To construct P from P, simply apply to P's target and input 
vectors the map Ylxi^Fo \x){w'{x)\ G £{V,C^"). Then 

• The target vector becomes \i) = J2xeFo \x){w'{x)\t) = X^xgFo 1^) ^ C^", as required for a 
canonical span program. The input vectors become, for i G I, l^i) = J2x<^Fo 

• For any x £ Fq and i G /(x), since {w'{x)\vi) = 0, {x\vi) = 0. 

• In particular, for i G /free; {x\vi) = for all x G Fq. Thus \vi) = 0, so the free input vectors 
may be discarded. 

Therefore P is a canonical span program. P is monotone if P is monotone, and P is real if P is 
real. 

Let A = Zi^j \vi){i\ = \x){w'{x)\A. 
For X G Fq, note that {t\x) = 1 and 

A^\x) =A^\w'{x)) . (5.2) 

In particular, n(x)^"^|x) = 0, so |x) is a witness for fp{x) = 0. Also, wsizes(P, x) < ||5A"''|x)|p = 
||S'A"l"|it;'(x)) Ip = wsizes(P, x). In fact, |x) is an optimal witness for fp{x) = 0. Indeed, assume 
otherwise, and let \u) = '^ZyeFo ^y\y) satisfy {i\u) = '^y^p^^ Uy = 1, Il{x)A^\iL) = and ||S'A"l'|-u) p < 
||5it|x)|p . Let \u) = EyeFo ^2/ (?/))> so A^u) = A^u). Then {t\u) = 1, n{x)A^\u) = 0, and 
= ||S'^'''|'u)|p < wsize<j(P, x), a contradiction. 
Next consider an x G -B" such that fp{x) = 1. Then 

in(x)|u;(x)) = \y){w\y)\AIi{x)\w{x)) 
y^Fo 

= Y \y){w'iym (5.3) 

= \i) . 
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Thus \w{x)) is a witness for fp{x) = 1, and wsizes(P, x) < ||S'|w(x)) 
Note that the canonical span program P from 



wsizes(P, x). 



□ 



Theorem 5.2 



depends on the cost vector s. In 
contrast, the strict span program P' from Proposition 4.10 has witness size equal to that of P for 
ah s G [0,cx))". 



6 Span program witness size and the general adversary bound 



In this section, we will use Theorem 5.2 to formulate a semi-definite program (SDP) for the optimal 



span program computing a boolean function /. Remarkably, this SDP turns out to be exactly the 



dual of the SDP that defines the general adversary bound for / (Definition 2.4). Thus the optimal 



span program witness size is exactly equal to the general adversary bound. This result has several 



corollaries, in quantum algorithms and in complexity theory, that we give in Section 7 

This result may be somewhat surprising, because the optimal span programs known previously 
were all for functions / with Adv(/) = Adv^(/) |RS08 . It is not clear why earlier attempts to 



find optimal span programs did not succeed for any function / with Adv(/) < Adv^(/). 
Theorem 6.1. For any function f : T> ^ B, with T> C i?", and any cost vector s G [0, oo)", 

inf wsizeJP,P) = Adv^(/) , (6.1) 
P-fph=f 

where the infimum is over span programs P that compute a function agreeing with f on D. More- 
over, this infimum is achieved. 



Before proving Theorem 6.1 let us show the following dual characterization of the general 
adversary bound: 

Theorem 6.2. For finite sets V C C", and E, let f : V ^ E, and let s G [0,00)" he a vector of 
nonnegative costs. If either C = {0, 1} or E = {0, 1}, then the general adversary hound for f, with 
costs s, equals 

Adv^(f)= min maxy^Si(x,i\X\x,i) . (6.2) 

v(x,s/)GF,Eje[„,:.^.^,^ (x,i|x|?;,j>=i ieW 

Sere X is required to he a positive semi- definite, {n\T>\) x (n|I?|) matrix, with coordinates laheled 
hy T> X [n], and F = {{x,y) D x D : f[x) 7^ f{y)}- The optimum is achieved. 

Proof. The proof is by a standard application of duality theory to the semi-definite program given 
Definition 2.4 Nonetheless, this expression for Adv^(/) is new, and is somewhat simpler than 



m 



the expression that was known before, Eq. (6.6)| below. Therefore we include a proof, based on the 
following immediate observation: 

Claim 6.3. Let M = ^j^gj^^] Mjk\j){k\ G /^(C'™"') he an m x m Hermitian matrix. Assume that 
either M is entry-wise nonnegative, i.e., Mjk > for all j,k G [m], or that M is hipartite, i.e., for 
some I e[m-l], M = T.j<i,k>li^^jk\j){k\ + Mkj\k){j\). Then M <lif and only if \\M\\ < 1. 
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Taking the dual of the SDP on the right-hand side of Eq. (6.2) we obtain 

such that 



max a 

f=EF"^!/l^'Xi'l F 
{/3:r>0} 



xy 



(6.3) 



Here = F o Aj = y^^.^.^y, \x){x^\y){y\ as in Definition 2.4 Also, V j < Sj Y2x Px\x){x\ means 

that the difference {sj^^^.jy f3x\x){x\) — Tj is a positive semi-definite matrix. In particular, this 
constraint implies that if sj = then axy = for all x,y with xj ^ yj; and that if axy ^ 0, then 
f3x > and l3y > 0. 

Thus we can change variables, letting T 



Like r, r can vary 
with 



over the set of adversary matrices, i.e., symmetric matrices supported only on those \x 
f{x) 7^ f{y)- The objective function becomes YIf (^l^ly) and, for j G [n], the constraint 
on Tj becomes Tj ^ Sjl, where Tj = T o Aj. 

Now if C = {0, 1}, then the matrices are bipartite — perhaps in a permuted basis — so each 
Tj is also bipartite, li E = {0,1}, then T is bipartite since it is supported only on F. In either 
case, by Claim 6.3 the condition Tj ^ Sjl is equivalent to ||rj|| < Sj. Therefore, after changing 
variables, the SDP becomes 

max {x\T\y) ^ PxPy such that /^/3a<l, Vj, ||rj|| < . (6.4) 

adversary matrices F ^— ' ^— ' 
{/3.>0} P 

Since any negative signs on the coordinates of the principal eigenvector of T can be absorbed into 
the matrix, without affecting the norms of the Tj, the objective function in Eq. (6.4) simplifies 
to ||r||, so we obtain Adv^(/). Since the dual SDP in Eq. (6.3) is clearly strictly feasible, by 
the duality principle |Lov03| Theorem 3.4] the primal optimum equals the dual optimum and the 
primal optimum is achieved. Eq. (6.2) follows. □ 

For completeness, we state without proof the dual forms of the adversary bounds for the case 
of functions without a binary input alphabet or boolean codomain: 



Theorem 6.4. For finite sets V C C", and E, let f : V 

As in 



x,yeV:fix)f^f{y) 



Definition 2.^ 



denote entry-wise matrix multiplication. 



let Ai 



^-2x. 



E, and let s £ [0,00)". Let F -- 
yev:x,^y, \x){y\ for j £ [n], and let 



Then the nonnegative-weight adversary bound for f, with costs s, equals 
Adv,(/) = 



min max > Sj(x\Xj 



i X) 



(6.5) 



The minimization is over \T>\ x \T>\ positive semi-definite matrices Xj, j S [n], that satisfy the 
entry-wise inequality Xj o Aj o F > F . (Note that Eq. ( 6.2) has the same form, except with the 
requirement that Xj o Aj o F = F.) 

The general adversary bound for f, with costs s, equals 



Adv±(/) 



mm 

Y,JXj-Yj)oAjoF=F 



max Sj{x\{Xj + Yj] 



(6.6) 
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Proof of Theorem 6.1 Lemma 6.5 constructs an SDP whose solution is the optimal witness size of 
a span program computing /. 

Lemma 6.5. Let f : D ^ B, with T> C B", be a partial boolean function. For b £ B, let 
Ff, = {x £ V : f{x) = b}. Then for any cost vector s E [0, oo)", 

inf wsizes(P,P)= inf max 7^ Sj|||fi:i)||^ . 

P--fph=f "^6N, xev ^ . 

{|D^j>eR'":a;eX'jG[n]}; VO-'J 

Proof. The proof is by establishing a correspondence between solutions to the constraints on 
the right-hand side of Eq. (6.7) and real, canonical span programs computing /p|x) = / with 
maXj-e[n],6eB \Ij,b\ < m. 

First let us prove the < direction. Given a solution let P be a span program with target 

xeFo 1^) ^ ~ ["^] £ [n],b £ B. These sets are not disjoint, so for k e 

use \vjbk) to denote the corresponding input vector, defined by \vjhk) = Ylxi^Fo-Xj^b {'^xj\k)\x). Thus 

-4:= ^ \vjbk){j,b,k\ 

je\n],beB,ke[m] 

= 2^ \x){3^Xj\ ® {vxj\ . 
For X G -Foi 1^*^') = 1^;) is a witness for fp{x) = 0; {x\t) = 1 but {x\vjxjk) = for all j,k. The 



witness size is = J2j 



■V' 



|2 



For X G Fi, let \w) = \j,Xj) \vxj). The condition that ^j-x-^y^ {'^yj\''^xj) = 1 implies that 
is a witness, AIl{x)\w) = A\w) = \t), so fp{x) = 1. The witness size is || 1^^)11^ = Xlj •^jlll'^ajj)!!^- 
Thus fp\v = f and wsizes(P,P) < max^; Yjj Sj\\\vxj)\\^- 

Now let us prove the > direction. Let P be a span program computing /p, with fp\T> = /• By 



Theorem 5.2 and Lemma 4.11 we may assume that P is real and in canonical form, and that for 



x) 
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each X G Fqi I^;) is an optimal witness for fp{x) = 0: wsizes(P, x) = 

Thus the target vector is \t) = XlxeFo 1^) ^^"^ input vectors lie in the inner product 
space R^". Let m = m.ax.j^^n],beB \Ij,b\- Without loss of generality, we may assume that \Ijfi\ = m 
for all j G [n] and b £ B. Indeed, if some index set Ij^h is smaller, then we can pad the span program 
with zero vectors labeled by (j, b) without affecting the witness size. Therefore, let Ijj, = [m] for all 
j G [n] and b £ B. These sets are not disjoint, so for k G Ij^t, use \vjbk) to denote the corresponding 
input vector. 

For X £ Fq, note that since the span program is canonical, {x\ vjx^k) = for all j £ [n] and 
k £ [m]. For j £ [n], let \vxj) = J2ke[m] {^jxjk\x)\k) . Then Eq. (6.8) again holds. Moreover, 
wsizes(P,2;) = ||S'A"l'|a;) |p = Thus maxajgpg Sj\\\vxj)\\'^ < wsizes(P, P). 

For X G Pi, on the other hand, let l^^;) be an optimal witness vector, i.e., satisfying \wx) = 
Il{x)\wx) = EjeM,fceH \j,Xj,k){j,Xj,k\wx), A\wx) = \t) and wsizes(P, x) = . For j G [n], 

let \vxj) = EfceM \k){j,Xj,k\wx). Then 

A\wx) = \t) =^ VyGPo, ^ {vyj\vxj) = l ■ (6.9) 
Finally, wsizes(P,x) = J2j Sj\\\vxj)\\'^ , so max^jgp^ Sj\\\vxj)\\'^ < wsizes(P,P). □ 
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Now the expression on the right-hand side of Eq. (6.1)| is just the Cholesky decomposition of 



the solution to the SDP in Eq. (6.2) 
claimed 



We conclude that infp. 



fp\T>=f 



wsize.(P) = Adv±(/), 



as 
□ 



Before stating some corollaries of Theorem 6.1 let us make a remark on the proof: 



Lemma 6.6. For a function f : T> ^ B, with T> C i?", assume that there is a rank-k optimal 
solution X to Eq. (6.2) for Adv^(/). Note that k < < n2"'. Then by the proof of Lemma 6.5 
there is an optimal span program computing f with \Ij^b\ = k for all j S [n] and b & B. 



HLS071 Theorem 18] states in particular that Eq. (6.5) always has a rank-one optimal solution. 
The proof takes the Cholesky decomposition of a solution X = Ylxyjj' \^->3){'^xj\vyji){y,j'\, and 



replaces each vector 



by the scalar 



That is, let X' = y 



J.J 



^^3 

a rank-one matrix. Then by the Cauchy-Schwarz inequality, {x, j\X'\y, j) > {x,j\X\y,j), with 
equality when y = x, so X' is as good a solution to Eq. (6.5)| as X is. However, note that even 
when A dv s{f) = 
solution Spa09 . 



AdVg (/), this argument does not imply that Eq. (6.2) has a rank-one optimal 



7 Consequences of the SDP for optimal witness size 



This section will state several corollaries of Theorem 6.1 First of all, we can strengthen Theo- 
Irem 3.11 

Theorem 7.1. For any function f : D ^ {0, 1}, with T) C {0, 1}", there exists a span program P 
computing fp\v = f with witness size upper-bounded by the bounded-error quantum query complex- 
ity of f, 

wsize(P, P) = 0(Q(/)) . (7.1) 



Proof. By Theorem 2.6 the quantum query complexity of / is lower-bounded by the general ad- 



versary bound for /, which by Theorem 6.1 [ equals the best span program witness size: 

Qif) = 17(Adv±(/)) 

= n( inf wsize(P,P)) . 
P--fp\T>=f ' 



(7.2) 

□ 



It is an interesting problem to prove Theorem 7.1 based directly on a quantum query algorithm 
that evaluates /, as in the proof of Theorem 3.1 for the one-sided error case. 

As an immediate corollary of Theorem 6.1 and Theorem 4.3 the general adversary bound com- 
poses multiplicatively for boolean functions. That is, the inequality in Eq. (2.17)[ from Theorem 2.7 
is actually an equality. 

Theorem 7.2 (General adversary bound composition). Let f : {0, 1}" {0, 1} and, for j £ let 
f. : {0, 1}™. ^ {0, 1}. Define g : {0, 1}-^ x • • • x {0, 1}-" ^ {0, 1} by g{x) = /(/i(xi), . . . , /„(a;„)) . 
Let s £ [0, oo)™! X • • • X [0, oo)'"", and let (3j = Advt,(/j) for j G [n]. Then 



Adv±(5)=Adv±(/) 



(7.3) 



In particular, if Advf^{fi) 



Adv± (/„) = (3, then Adyfig) = /3Adv±(/). 
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Proof. Theorem 2.7 gives the inequahty Advf{g) > Adv^(/). To obtain the opposite inequahty, 
appeal to I'heorem 6.1 to obtain optimal span programs for the functions, compose these span 
Theorem 4.3, and appeal to Theorem 6.1 to upper-bound Advf{g). 



programs using 



This proof is rather indirect. Based on the new formulation of the general adversary bound in 



Theorem 6.2, we can also give a direct proof of Theorem 7.2|that does not use span programs. 



Recall that B = {0,1}. For x E B™i x ••• x 5™", let y{x) = . . . , so g{x) 



For y £ i?" and j £ [n], fix vectors \vyj) £ V that achieve Adv^ (/), i.e., ^j-y-^y ^ { 



for ah y,y' £ with f{y) / f{y'), and Adv^(/) = maxye^n J2je[n] Pj\\\^yj)f- For j £ [n], fix 
vectors \vlf^) £ for z £ B""^ , k £ [mj], that achieve AdvJ(/j), i.e., J^k-.z^^z'^ (vikK'k) = 1 
ah z,z' £ B™J with fj{z) / fj{z'). 

Based on these solutions, we construct a feasible solution for the dual formulation of Advf{g). 
For X £ B"^^ X • • • X i?™", j £ [re] and k £ [rrij], let 



(7.4) 



Here, the third register is spanned by the orthonormal basis {|0), |1)}, and 6a^b is 1 if a = 5 and 
otherwise. 

Consider x,x' £ B"^^ x • • • x B'^" such that g{x) ^ g{x'). In particular, y{x) ^ y{x'). Then 



Wx'jk) 

jG[n],kG[mj]: 



je[n] k<^[mj]:Xjk¥=x'.f, 



j£[n]:y{x)j^y{x')j ke[Tnj\.Xjj,^x'^^ 



j&[n]:y{x)ji^y{x')j 
1 . 



(7.5) 



Hence indeed the vectors \wxjk) give a feasible solution. We conclude that 



Adv. iq) < max 



Y Sjk\\\Wxjk)\ 



je[n],fcG[mj 



= max ^ |||i;y(^)j-)f Y ^jfcH I'^x.-fc) if 

ie[n] k&[mj] 

<max^ /3j-|||t.y(^)j-)f 



Adv±(/) 



(7.6) 



The last step is clearly an inequality, which is all we actually need to finish the proof. It is in fact 
an equality, though, because y{x) varies over all strings in i?" as x varies over B'"^^ x • • • x i?"*". □ 



By substituting Theorem 6.1 into Theorem 1.1, we obtain an exact asymptotic expression for 
the quantum query complexity of a boolean function / composed on itself. 
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7 k 

Theorem 7.3. For any function f : {0, 1}" —>■ {0, 1}, define f : {0, 1}" —>■ {0, 1} as the function 
f composed on itself repeatedly to a depth of k, as in Theorem Then 



lim Q{f 

fe— ♦oo 



k\l/k 



Proof. By th e adversary lower bound 
Hence hminffc^oo 



Theorem 2.7 



evaluation algorithm 
Adv±(/). 



Theorem 2.6 
Qi^fkyik > Adv±(/) 



Adv±(/) . (7.7) 
Qi f^) = 17(Adv ^(/^)) = ^{MY^{ff) by 



Theorem 1.1 



Theorem 6.1 



together with the formula- 
implies QU") = Ok{Mw^[fY). Hence YimsnVk^^Q{f^Y'^ < 

□ 



[Theorem 7.3| implies a new asymptotic upper bound on the sign-degree of a boolean function / 
composed on itself to a depth of k, as k ^ oo. 

Definition 7.4 (Sign-degree). Given a function f : {0, 1}" {0, 1}, a real multivariate polynomial 
p{xi, . . . , Xn) is said to be a threshold polynomial that sign-represents f if for all inputs x £ {0, 1}", 
p{x) 7^ and the signs of p{x) and ( — l)'^^^) coincide. 

The sign-degree of f, sign-degree(/), is defined as the least degree of a polynomial that sign- 
represents f. 



By the polynomial method jBBC+Oll INCOOj . sign-degree(/) = 0{Q{f)) for every boolean 
function /. (See also Refs. |MNR07| IBVdW07] . which relate the sign-degree of / to the unbounded- 
error quantum and classical query complexities of /.) Thus we obtain the following corollary of 
[Theorem 7.3t 



Corollary 7.5. For any function f : {0, 1}" {0, 1}, 



lim sup sign-degree(/ 

fe^oo 



k\l/k 



< lim Qif 

K— »00 



k\l/k 



Adv±(/) . 



(7i 



Lee and Servedio have recently shown that sign-degree(/)'^ < sign-degree(/^) |Lee09] . based on 



which Corollary 7.5 gives an upper bound of the sign-degree of / itself. 



One special case of interest is when / is a read-once AND-OR formula on n variables. In 
this case, Adv(/) = Adv=*=(/) = ^/n |BS04j . Indeed, these bounds can be computed by show- 

^)(AND, 



where AND™ denotes the AND 



ing Adv(,,,.,.,,^)(AND^) = Advf^^^ (AND^) = ^ E,gH 
gate on m variables, and then using Theorem 2.7 and [Theorem 7.2 to compose the nonnegative- 
weight and general adversary bounds, respectively. O'Donnell and Servedio [OS03j asked whether 
sign-degree(/) = 0(-y/n)? This question has consequences in learning theory [KSOTI IKOS04] . Am- 
bainis et al. proved that sign-degree(/) = n^/'^~^°W by giving a quantum algorithm, and, therefore, 
an explicit threshold polynomial 



ACR+n7 



Combined with the unpublished result of Lee and 
Servedio mentioned above. Corollary 7.5 will close this question. In fact, though, [A CR"'"07 with 
Lee and Servedio 's result already suffices; the composed function f^ is an "approximately bal- 
anced" formula for any fixed AND-OR formula /, and, by another result of |ACR"'"07j . therefore 



sig n-degree(/^) = 

Theorem 1.1 is only a special case of the formula-evaluation result from |RS08 . That article's 



main result, ^RSOSt Theorem 4.7], can also be extended. Fo r brev ity, we will not repeat all the 
notation and definitions, but will just state the extension. |RS08 used the nonnegative-weight 
adversary bound Adv instead of the general adversary bound Adv^ throughout, be cause only for 
functions / with Adv(/) = Adv^(/) had the authors found matching span programs. Theorem 6.1 
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however, gives optimal span programs for every boolean function /. Thus if we modify RS08 
Def. 4.5] , defining adversary-balanced formu las, t o refer to Adv^ instead of Adv, and if we let S 
be any finite gate set of boolean functions, ^RSOSl Theorem 4.7] becomes: 

Theorem 7.6. There exists a quantum algorithm that evaluates an adversary-balanced formula 
f{x) over S using 0{Adv^{(p)) input queries. After efficient classical preprocessing independent 
of the input x, and assuming 0{l)-time coherent access to the preprocessed classical string, the 
running time of the algorithm is Adv^(99)(log Adv^((/7))'^(^). 



Aside from changing Adv to Adv , the proof from jRSOSj goes through entirely. Note that 



layered formulas, in which gates at the same depth are the same, are a special case of adversary- 
balanced formulas. 



8 Correspondence between span programs and bipartite graphs 



In this section, we define a correspondence between span programs and weighted bipartite graphs, 
slightly generalizing the correspondence from RS08 . We also analyze the spectra of these graphs. 



focusing on eigenvalues near zero and eigenvectors supported on one particular "output vertex." 
The main result, [Theorem 8.3 relates spectral quantities of interest to the span program witness 
size. This is the key theorem that allows span programs to be evaluated on a quantum computer. 



Theorem 8.3 s proof has two main steps. The first step, an eigenvalue-zero analysis given in 
Section 8.1 is essentially the same as the argument in |RS08 . However, the second step, analyzing 



small, nonzero eigenvalues, is novel. Section 8.2 gives a general argument that relates properties of 
eigenvalue-zero eigenvectors of weighted bipartite graphs to what are in a certain sense "effective" 
spectral gaps. 

The small-eigenvalue 



This small-eigenvalue analysis substantially extends the proof in |RS08 



analysis in |RS08| only works for span programs that arise from the concatenation of constant-size 
span programs with constant entries, with strict balance conditions, and it breaks down when these 
conditions are relaxed. For example, (RS08 shows spectral gaps of J7(l/wsize(P)) away from zero, 
for a span program P, but the spectral gaps for general span programs cannot be lower-bounded in 
terms of the witness size. The small-eigenvalue analysis in (RS08 is also more technically involved. 
Theorem 8.3 implies a simpler proof of [Theorem 1.1 and [Theorem 7.6 as well as for the AND-OR 
formula-evaluation result in jACR"'"07] . 

Definition 8.1. A finite, weighted, bipartite graph G is specified by finite sets T and U, and 
Bg G £(C^,C-^) the "biadjacency matrix." G has vertices {rj : i G T} U {/ij : j G ?7}. For each 
i G T and j £ U with {i\BG\j) ^ 0, G has an edge {Ti,fij) weighted by {i\BG\j). The weighted 
adjacency matrix of G, Aq G £(C^ © C^), is 



Ag 

Henceforth all graphs will be finite, 
span program, recall also the definitions A 



B. 



U 

BgY 
ju 



ie/(x) 



\i)(i\. Let 



H(x) 



Recall from Section 2 

n(x)= Yl I^X^I 



(8.1) 

that B = {0, 1}. For a given 
= -^froe U Uje[n] ^nd U{x) = 



i.2) 
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Now the correspondence between span programs and weighted bipartite graphs is given by: 



Definition 8.2 (Graphs Gp{x)). Let P he a span program with target vector \t) and input vectors 
\vi) for i €z I = /free U UjeH beB ^j,b' inner product space V. Fix an arbitrary orthonormal basis 
{\k) -.ke [dim{V)]} for V. 

Let Gp be the weighted bipartite graph with T = [dim(y)] U L, U = {0} U / and the biadjacency 
matrix 

Bo. ^ (i (S.3) 

The vertex is called the "output vertex. " 

Note that for each input vector index i £ I, Gp has two corresponding vertices, with a weight- 
one edge between them. For x E , let Gp{x) be the same as Gp except with these weight-one 
edges deleted for all i G I{x). That is, Gp{x) has the biadjacency matrix 

/ 



[Definition 8.2 is a modest generahzation of the correspondence between span programs and 



bipartite graphs given in |RS08| Sec. 2]. The difi'erence is that jRSOB] only defines Gp{x) for span 



programs with target \t) = (1, 0, 0, . . . , 0). This is not a very restrictive requirement, though, since 
a unitary change of basis can ensure that \t) = (|||t)||,0, . . . ,0). 

It will be convenient to establish some more notation. Any vector 1-0) G C'^ © can be 
uniquely expanded as IV') = (IV't), IV'l/))) with IV't) £ and jV'i/) G C^. For the graphs Gp{x), 
C'^ = V and = C^°^ © , so any \ip) E © can similarly be written = 

((|V'T,y),|V'T,/)),(V'c/,o,|V'l/,/)))- Let |0) = (0,1,0) E C^©CW©C^ be the unit vector on vertex //q- 
With this notation, the eigenvalue-/? eigenvector equation of vlc'^(^), 

p\tP) = Ag^^.)\4^) , (8.5) 

is equivalent to the four equations 

pl^pry) = i^u,o\t) + A\i;u,i) (8.6a) 

pIV't,/) =n(x)|0[/,7) (8.6b) 

pi^Ufi = {t\4^T,i) (8.6c) 

p\i^u,i) = A^i^Ty) + Tlix)\ijT,i) ■ (8.6d) 

Our main result is: 

Theorem 8.3. Let P be a span program and T) C B"^ . Then a span program P' can be constructed 
such that fpi = fp and, for all x E 

• U fp{x) = 1; then there is an eigenvalue-zero eigenvector |0) of Aq^,(^^-^ with 
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If fp{x) = 0; {W)} ^ complete set of orthonormal eigenvectors of Aq ,(-^.-), with cor- 
responding eigenvalues p{a). Then for any c > 0, the squared length of the projection of |0) 
onto the span of the eigenvectors a with \p{a)\ < c/wsize{P,T>) satisfies 



E 



\{a\0)f < 8c2 



|p(a)|<c/wsizc(P,X') 



1 + 



wsize(P, D) 



< I6c^ 



(8.8) 



Roughly, Eq. 



Msays that Aq has an effective spectral gap around zero. We will see in 
Qii: 



Section 9| below that this is strong enough for applying quantum phase estimation. 

an eigenvalue-zero analysis of 



The two main ingredients required for proving Theorem 8.3 



Aqp{x) and an analysis relating eigenvalue-zero eigenvectors to the effective spectral gap. These 
two ingredients are presented in Section 8.1 and Section 8.2 below. Section 8.3| will put them 



together to prove Theorem 8.3 



Theorem 8.3 is quite useful. However, we will see in [Section 9 below that for some applications 



usmg 



Theorem 8.3 as a black box can lead to an 0(log n) overhead in the quantum query complexity. 



Theorem 9.1 will include two quantum query algorithms. The more specialized algorithm does not 
incur a logarithmic overhead, but requires that the norm of the adjacency matrix be at most a 



constant. However, the span program P' that Theorem 8.3 outputs will not necessarily satisfy 
1 1 ^Gp/ II = 0(1), so only the first algorithm applies. Thus if one cares about saving logarithmic 



query overhead factors. Theorem 8.3 cannot be applied as a black box. 

It is possible that the first algorithm in [Theorem 9.1 can be improved to work without the 
logarithmic overhead even when ||j4g^, || = u;(l). See Conjecture 11.1 Even if this turns out to be 



the case, though, there will be an important case when we cannot apply Theorem 8.3 as a black 
box, namely, when we wish to prove upper bounds on the time complexity of the algorithm. 

For developing time-efficient quantum algorithms, other properties of the adjacency matrix 
besides the norm, such as the maximum degree of a vertex, also matter |CNW09] . This article is 
concerned primarily with the query complexity of quantum algorithms and not the time complexity. 
Investigating the tradeoffs involved in designing span programs for query-optimal and nearly time- 
optimal quantum algorithms is an important area for further research, but is beyond our scope. 



With an eye toward these applications, though, we give a version of Theorem 8.3 that applies 
to the graphs Gp{x) directly instead of to Gpi{x): 

Theorem 8.4. Let P be a span program, and for x £ let Gp{x) he the weighted bipartite graph 



from Definition 8.2. Then for x G : 



If fp{x) = 1, let \w) £ be a witness, i.e., AIi{x)\w) = \t). Then Aqp(^^^ has an eigenval 
zero eigenvector {ip) with 



ue- 



> 



1 + Ilk) 



(8.9) 



If fp{x) = 0, let \w') € V be a witness, i.e., {t\w') = 1 and Il{x)A'^\w') = 0. Let {\a)} be 
a complete set of orthonormal eigenvectors of A^^f^^^, with corresponding eigenvalues p{a). 
Then for any T > 0, 



a:\p{a)\<r 



\{am'<8T'(\\\w')f + \\A^w') 
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A typical application of Theorem 8.4 will start with a span program having witnesses in the 

w')f + \\A^\w')f)]<W , (8.11) 



true and false cases satisfying 

{ 



max-! max \\\w) 



, max ( 

x:fp{x)=0 



for some W. Scale the target vector down by a factor of l/yVF, and apply Theorem 8.4; Eq. (8.9) 



then holds with 1/2 on the right-hand side, and letting T = c/W the right-hand side of Eq. (8.10) 



becomes 8c^. See Theorem 9.3 



and 



10) depend on quantities, 



\w) 



and 



Although the upper bounds in Eqs. (8.9) 

), similar to the witness size, for two reasons they are not the same as the witness size. 



+ 



First, in the case fp{x) = 1, 



\w) 



can be greater than wsize(P, x) if P is not strict (Defini 



tion 4.9), because the witness size does not count the portion of \w) supported on /free- 



Second, in the case fp{x) = 0, while it is true that can be bounded by wsize(P, x), 

the term is not necessarily so-bounded. This is clear because simultaneously scaling 



the target and all input vectors by c > leaves the witness size invariant (Lemma 4.12) 

|2 



but multiplies by 1/c^. The effective spectral gap of Aqp(^^^ certainly should not be 

invariant under such scaling, and should approach zero as c approaches zero. 



Theorem 8.4 therefore motivates using W in Eq. (8.11) as a new span program complexity mea- 



sure. This measure is important for developing time-efficient quantum algorithms based on span 



programs, as in for example Theorem 7.6 



The proof of Theorem 8.4 will also be given below in Section 8.3 



8.1 Eigenvalue-zero spectral analysis of the graphs Gp{x) 

We will begin by analyzing Eqs. |(8.6) at eigenvalue p = 0. This theorem is a straightforward 
extension of (RS08 Theorems 2.5 and A. 7]. 

Theorem 8.5 (HSOS]). For a span program P and input x G S", consider all the eigenvalue-zero 
eigenvector equations of the weighted adjacency matrix ^g'p(x)i except for the constraint at the 
output vertex fio, i-e-, Eqs. (8.6) except (8.6c) at p = 0. 

These equations have a solution with tpufi 7^ i/ and only if fp{x) = 1, and have a solution 
with 7^ i/ and only if fp{x) = 0. More quantitatively, let s G [0,oo)" he a vector of 



nonnegative costs, and recall from Definition 2.3 that S = beB ieij t \/^\'^){'^\- Then 

= (o,V't/,o,IV'c/,/)) ec^ecw, 



If fp{x) = 1, Aqp(^^-^ has an eigenvalue- zero eigenvector 
with 



> 



\i^u,of + \\S\4^u,i)f ~ l + wsize,(P,x) 



^.12) 



// fp{x) = 0, let \w') G V h e an optimal w itness, i.e., {t\w') 
\\SA^\w')f = 

e to Eqs. (8Jh,h,d) at p = 0, with 



V 



1, n{x)A^w') 



and 

wsizes{P,x) (see Definition 2.3). Then there is a solution {ip) = {\ipTy), \tpT,i), 0) G 



\mT,v)\' 



TV) 



+ W' 



> 



1 



'TJ) 



\w')\\ +wsizes{P,x) 



i.l3) 
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Proof. Let p = 0. Since Gp{x) is bipartite, the tpT terms do not interact with the ipu terms. In 
particular, Eqs. ( |8.6| ;,d) (resp. |8.6^ ,b) can always be satisfied by setting the (resp. il^jj) terms 
to zero. Fix s G [0, oo)". 

Now Eqs. (8.6i,b) are equivalent to — V^l/.ol^) = Mi^u,i) and \'4)u,i) = n(x)|'0[/^/). If these 
equations have a solution with 7^ 0, then —\il>u,i)/'4'u,Q is a witness for fp{x) = 1. Conversely, 
if fp{x) = 1, then let \w) E be an optimal witness, satisfying AIl{x)\w) = \t) and wsiz egfP, x) 
||S'|'u;)f . Let -ipufl = -1 and IV-c/,/) = Il{x)\w). Then \i 



(0,'i/'c/,05 li^uj)) satisfies Eqs. (8.6) 



and 



Eq. 1(8.12)1 with equality. 

Next, assume that IV') solves Eq. [(8.6d)| with {t\TpT,v) + 0. Then n(j;)^t|^y^^) = -n(a;)lT(x)|V'T,/) 
0, so |V'T,y)/(i|V'T,v) is a witness for fp{x) = 0. Conversely, assume that fp{x) = and let \w') be 



an optimal witness. Let \ipTy) = \w') and \ipT,i) = —A^lw'). Then lip) = {\ipT,v) 



Eqs. (8.6 3,,b,d), and Eq. (8.13) with equality. 



I^T,/), 0) satisfies 
□ 



Note that if the costs are uniform s = 1, then S = 1 — J2iei KX^I) so ||5|?/';7,/) ||^ ^ 



and IISIVt,/)!!^ < II IVt,/) 11^- If P is also a strict span program, i.e., /free = 0, then S = 
bot h these inequalities are equalities, and the denominators on the left-hand sides of Eqs. 
and (8.13) are, respectively, |||V'C/)||^ and |||V't)||^- However, if P is not strict, then Eqs. 
and (8.13) do not imply lower bounds on achievable |V'!7,o|^/|| IV'C/) 11^ or K^I^t,v)|^/|||V't)|P- 



= 1 so 



^.12 



^.12 



Corollary 8.6. Let P be a span program. Then there exists a span program P that computes 
fp = fp, and such that, for all x £ B^, 



If fp{x) = 1, then there is an eigenvalue- zero eigenvector 



o/^Gp(x) with 



\lpUfi 



> 



1 + wsize(P, x) 



If fp{x) = 0, then there is a solution to all the eigenvalue-zero eigenvector equations of 
■^Gp(x)y except for the constraint at vertex ^q, with 



\{tWy)Y 



> 



1 + wsize(P, x) 



^.15) 



14) follows from 



Proof. Let P be the canonical span program constructed in Theorem 5.2 fo r costs s = 1, with 
wsize(P,x) < wsize(P, x) for all x G B^. P is in particular strict, so Eq 
Eq. [(8l2 ^ 

that an optimal witness \w') for fp{x 



For showing Eq. (8.15) recall from 



Theorem 5.2 



may be taken to be \x) itself, so 



\w 



1 in Eq. (8.13) 



This completes the eigenvalue-zero analysis of the graphs Gp{x). 



8.2 Small-eigenvalue spectral analysis of the graphs Gp{x) 



Theorem 8.5 



implies in particular that when fp{x) = 0, does not have any eigenvalue-zero 

eigenvectors supported on the output vertex fiQ. Therefore Aq^)^^-^ has some spectral gap around 
zero for eigenvectors overlapping |0). This spectral gap can be arbitrarily small, though, because 
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Gp{x) can be a very large graph and its edge weights are poorly constrained. In fact, though, the 
lower bound Eq. (8.13) can be translated into a good lower bound on an "effective" spectral gap. 



That is, we can upper-bound the total squared support of |0) on small-magnitude eigenvalues of 

AGp{x)- 

The main result of this section is: 

Theorem 8.7. Let G be a weighted bipartite graph with biadjacency matrix Bq E £(C^,C"^). 
Assume that for some 6 > Q and \t) G C-^, the weighted adjacency matrix Aq has an eigenvalue- 
zero eigenvector l-i/^) with 



^.16) 



Let G' be the same as G except with a new vertex, fio, added to the U side, and for i £ T the new 
edge {Ti,no) weighted by {i\t). That is, the biadjacency matrix of G' is 



5, 



G' 





{\t) 



u 

Bg)T 



^.17) 



Recall that |0) = (0,1,0) G © C^°^ © C^. Let {\a)} be a complete set of orthonormal 
eigenvectors of Aqi , with corresponding eigenvalues p{a). Then for all T > 0, the squared length 
of the projection o/ |0) onto the span of the eigenvectors a with \p[oi)\ < T satisfies 



\{am'<8T'/5 



(8.18) 



a:|p(a)|<T 

This theorem ap plies to the case of a strict span program P with fp{x) 

with s = l,6 = l/(|||u;')f wsize(P,a;)). 



Gp{x) and, from Eq. (8.13) 



0, by letting G 



To motivate our approach to proving Theorem 8.7 let us recall some basic properties about the 
eigenvalues and eigenvectors of bipartite graphs. 

Proposition 8.8. Let G be a weighted bipartite graph with biadjacency matrix Bq and adjacency 
matrix Aq- 

Assume that IV') = (|'0r)) IV'C/)) £ C^©C^ is an eigenvalue-p eigenvector of Aq, for some p^^- 
Then (IVt), — |^c/)) is an eigenvector of Aq with eigenvalue —p. Moreover, l^r) = -Bg\'4'u) is an 



eigenvector of BqBq and \ipu) 
eigenvalues p^ . 



IS an 



eigenvector of BqBq, both with corresponding 



Conversely, if \ip) G C is an eigenvalue-X eigenvector of BqBq for A > 0, then -BgIv') £ C 



G 

is an eigenvalue-X eigenvector of BqBq and \'4'±) = {\ip) , ^-^BqIcp)) G 
of Aq with corresponding eigenvalues it-v/A. 



are eigenvectors 



The proof is immediate. 

Thus the spectrum of Aq is symmetrical around zero, and nonzero-eigenvalue eigenvectors 
of the positive semi-definite matrix BqBq are in exact correspondence to symmetrical pairs of 
nonzero-eigenvalue eigenvectors of Aq- 

[Proposition 8.8 allows us to translate the claims of Theorem 8.7 into claims on spectral prop- 
erties of positive semi-definite matrices. We will start, though, by proving the necessary result for 



positive semi-definite matrices. Theorem 8.9 below. After proving Theorem 8.9, we will give the 



translation to prove Theorem 8.7 
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Theorem 8.9. Let X € C{V) he a positive semi- definite matrix, \t) ^ V a vector, and let X' = 
X + \t){t\. Let be a complete set of orthonormal eigenvectors of X' , with corresponding 

eigenvalues A(/3) > 0. Assume that there exists a \ip) € Ker(X) with \{t\ip)\'^ > 6\\\ip)\\'^. Then for 
any A > 0, 

^ E T^imi'<4A. (8.19) 



/3:A(/3)<A 



Proof. The sum is weh-defined, with no division by zero, because any with ^ must have 



m = {P\x'\ 



\X\B) + 



> 0. 



The key lemma for proving Theorem 8.9 



is: 



Lemma 8.10. Under the conditions of \Theorem 8.9 . for any \^) G V , 

5\m\'<\\x%)f . 



^.20) 



Moreover, if \£) is a linear combination of eigenvectors with corresponding eigenvalues at most k, 
^•e-, 10 = E/3:A(/3)<K il^lOlP)^ then 



5\{t\0\'<K' 



i.21) 



Proof. We will write the matrices X and X' out in coordinates. Fixing (t|0, we will use straight- 
forward calculus to minimize ||X'|0||^. 



Let |1), . . . , \ m) be a complete, orthonormal set of eigenvectors for ( 1 



with corresponding eigenvalues ai , 02 , 
given by 



X 



In the coordinates ( mtot, |1)) • • • , I'tz)) , X and X' are 



\m 



XI 



\m 



ii 



( 



X' 



hi ai 

\bm 

/«+ III*) 
bi 

\ bm 



bm\ 


a-mj 



i.22) 



bi 
ai 



bm\ 




^.23) 



where a = {t\X\t) /\\\t)f and bj 



By incorporating any phases into the basis vectors we may assume that all bj > 0. Fur- 
thermore, we may assume without loss of generality that all bj > 0. Indeed, if some bj = 0, then 
the I j) coordinate lies in a different block of X' from so removing this coordinate will not affect 
min|^^ Since X ^0, all aj > 0. Moreover, if some aj = 0, then since ( ) is a 

(positive semi-definite) submatrix of X, it must be that bj = 0. Hence we may assume that aj > 
for all j G [m]. 

We are given the existence of a \ip) G Ker(X) with |(t|93)|^ > (5|| ||^. Let us write out this 
condition in coordinates. By scaling \{p), we may assume that {t\if) = \\\t)\\. Thus, written in 
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coordinates, \ip) = (1, — . . . , — and {t\X\ip) = implies that 



1.2A) 



The condition > in coordinates, is 



> 



m 



i.25) 



We can now solve the minimization problem: 
Claim 8.11. 

min 

l«>:(*IO = ll|i>ll 



1 + 



.,^2>'^iii*)ir • 



^.26) 



Proof. Since X' is a symmetric matrix, we may assume that |^) has real coordinates. Introduce 
variables ci, . . . , Cm and let |0 = (1, ci, . . . , Cm)- For j G [m], let = aj {^Cj + l). Then 

ii^'io f = (« + II \t)f + E ^i^i)' + E(^^- + «^-^^-)' 

-(-||wlp^EJ(^>))^E(^ 



3 



^.27) 



where we have substituted Cj = ^ — l) and then used Eq. (8.24) 



A global minimum exists and will satisfy, for all j £ [m] , 

0=^11X1011^ 



to cancel a from the first term. 



7. + ll|t)f + E 



CLk 



Ik 



i.28) 



Thus we should set all equal, 'jj = 7 for j G [m], where 7 = 
Substituting back into Eq. (8.27) ||X'|0|p at the minimum is 



7(1 + 5) and5 = E,(|)' 



x'\of = iimr + Sir + 

7(1 + 5) , 



as claimed. 



(8.29) 

□ 



Eq. (8.20) follows. Eq. (8.21) is an immediate consequence of Eq. 



implies ||X'|^)|| < k|||OII- This completes the proof of Lemma 8.10 



^since|e)=E/3:A(;3)<.(/3|OI/?) 

□ 
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Now let us derive Eq. |(8.19) by bootstrapping [Lemma 8.10 We aim to bound 

1 , .A ^ 1 



/3:A(/3)<A 



< 



A 



k=0 



A 



^.30) 



fc=0 



where \tk) = Ylg-—^<\(g)<-^ the projection of \t) onto the span of the eigenvectors with 



erefore {t\tk) 

can be applied with |^) = \tk) and k = A/2'' to continue: 



eigenvalues in A]. Therefore {t\tk) = {tk\tk) = \{t\tk)f /\\\tk)f when \tk) + 0, so Eq.|(8.21) 



/3:A(/3)<A 
(t|/3>^0 



fc=0 



A\2 

2^ 



oo ^ 

2AE5 



A;=0 



2fc 



= 4A , 

as claimed. 

With [Theorem 8?9 in hand, we can now apply Proposition 8.8 to prove Theorem 8.7 



^.31) 

□ 



^.32) 



Proof of Theorem 8.7 We are given an eigenvalue-zero eigenvector of Aq, (|'0t),O) G C 
with KtlVr)!^ > '^IIIV't)!!^ • In particular, B^I^t) = 0. 

An eigenvalue-zero eig envector |C) = (|Ct>, Co, \Cu)) G © C^°} © has to satisfy 

= Bg'{Co,\Cu)) 
= m + BG\Cu) ■ 

Since K^IV't)! > and BqIiPt) = 0, \t) cannot lie in the range of Bq, so Co must be zero. Thus 
follows the claim for T = 0, that Ac has no eigenvalue-zero eigenvectors supported on ^q- 

Now to show Eq. (8.18) for T > 0, note that for each eigenvector |q) of Aqi, p{a){0\a) = 
{0\AG'\a) = {t\aT)- Therefore 

1 >,9 



Q:|p(a)|<T 



E 



o:0<|p(a)|<T 



p{a) 



.33) 



Let X' = Bq/Bq,. Let {\(3)} be a complete set of orthonormal eigenvectors of X', with correspond- 
ing eigenvalues A(/3). By Proposition 8.8, each eigenvector with A(/3) ^ corresponds to a pair 
of eigenvectors of Aqi with eigenvalues ity^ A(/3). The above sum therefore equals 

2 E ^\mf ■ (8.34) 



/3:0<A(/3)<T' 



A(/3) 
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Now apply Theorem 8.9 with X 
the claimed upper bound of 8T'^/6. 



X' - \t){t\ = BgBI >z 0, = \iPt) and A 



T^, to obtain 
□ 



8.3 Proofs of rTheorem 8T3l and [Theorem 8.41 



Let us now combine Theorem 8.5 and Theorem 8.7 to prove Theorem 8.3 and Theorem 8.4 The 



proof of jTheorem 8.3 will also use the canonical span program reduction, Theorem 5.2 



Theorem 5.2 



for costs 
0, an 



Proof of Theorem 8.3\ Let P be the canonical span program constructed in 
s = 1, with wsize(P, < wsize(P, x) for all x £ B^. In particular, recall that when fp{x) 
optimal witness \w') may be taken to be \x) itself. Also, P is strict, i.e., has /free = 0, so 5 is the 
identity on C^. 

Let P' be the same as P except with the the target vector scaled by a factor of 1 
Thus fpi = fp still, and, for all x G P, 



wsize(P, V). 



wsizefP ,x) < { r. 

[wsize(P,P)^ if/p(x)=0 



^.35) 



Now, when fp'{x) = 0, an optimal wit ness is \w ') = Y^wsize(P, 'D)\x). This scaling step is known 
as amplification. It was introduced by |CRSZ07 and also applied in [ACR^07 RS08 . 

For the case fp{x) = 1, the first part of [Theorem "Ol Eq. [(8.7)[ now follows from Eqs. [(8.12) 



and 



^.35) 



since S = 1, 



For the case fp{x) 



\i^uflf + \mu,i)r- 

0, let G be the graph Gp{x) with the output vertex fiQ and all incident 



edges deleted. Thus G's biadjacency matrix is the same as Bq^)^^^ from Eq. (8.4) except with 
the HQ column deleted. Theorem 8.5 implies that Aq has an eigenvalue-zero eigenvector l-^) = 
{\i'T,v),\i^T,i),0) e y e © satisfying 



\mT,v)\' 



> 



1 



\\\w')\\ + wsize(P', x) 
1 

wsize(P,P)(wsize(P,P) + 1) 



(8.36) 



by Eqs. [(SlS)] and [(8.35)] Eq. .. , 

T = c/wsize(P,P) and 6 = l/(wsize(P,P)(wsize(P,P) +T)). 



now follows by Eq. [(8.18) in Theorem 8.7 with G' = Gp{x 



□ 



Proof of Theorem 8.4 The idea is that we want to charge for the free input vectors of P. Let 
P' be a strict span program that is the same as P except with one extra input bit, and with the 
free input vectors of P now labeled by (n + 1, 1). That is, Ij^ = Ij^b for j £ [n] and b £ B, but 

/free- Then for all x G P", /p/(x,l) = fp{x), with the same 



T' — T' 
-'free ~ ^n+lfl 



and 



witnesses, and Gp'{x, 1) = Gp{x). The only difference is that in the case fp{x) = 1, wsize(P', x) 



mm 



\w):AIl{x)\w) = \t) 



counts the portion of \w) on indices in /free, while wsize(P, x) does not. 



The proof now follows the same steps as the proof of Theorem 8.3 except with (5 = 1/ 
the case fp{x) = 0. 



w 



■ + 
□ 
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9 Quantum algorithm for evaluating span programs 



In this section, we will connect quantum query algorithms to the graph spectral properties that 
are the conclusions of Theorem 8.3| and Theorem 8.4 The following theorem gives two quantum 
algorithms for evaluating a total or partial boolean function / based on promised spectral properties 
of a family of graphs {G{x) : x £ D}, with D C B^. 

Theorem 9.1. Let G = (y,E) be a complex-weighted graph with Hermitian weighted adjacency 
matrix Aq G £(C^) satisfying {v\Ag\v) > for all v £ V . Let Vinput be a subset of degree-one 
vertices of G whose incident edges have weight one, and partition Vinput o.s Vi 

-^je[n]yj,xy 



' input 



Llje[n],fee-B ^'.fe- 
Let ^G(x) G /:(C^) 



For X G i?", define Gix) from G by deleting all edges to vertices in U^g 
be the weighted adjacency of matrix of G{x) . 

Let f : D ^ B, with D C B'^, fj, £ V \ Vinput, e = ^(1) CL'^d A > 0. Assume that for all x £ D 
the graphs G{x) satisfy: 

• If f{x) = 1, then Aq(^.j.-^ has an eigenvalue-zero eigenvector G with 



\{i^m 



> e 



(9.1) 



// f{x) = 0, let {\a)} be a complete set of orthonormal eigenvectors of Aq(^.^^, with corre- 
sponding eigenvalues p{a). Assume that the squared length of the projection of onto the 
span of the eigenvectors a with \p{a)\ < A satisfies 



E k«ia^)i'<^/2 



(9.2) 



a: |p(a)|<A 



Let abs(^G) be the entry-wise absolute value of Aq, and let \\ ahs{AG) 
Then f can be evaluated with error probability at most 1/3 using at most 



O min 



abs(^G)|| 1 logi 



A 



A log log 4- 



be its operator norm. 



(9.3) 



quantum queries. 

The intuition behind this theorem is that / can be evaluated by starting at and "measuring" 
^G{x) to precision A. (More precisely, this is implemented by applying phase estimation to a 



certain unitary operator.) Output 1 if and only if the measurement returns 0. Eq. |(9.1) implies 
completeness when /(x) = 1, because the initial state has large overlap with an eigenvalue-zero 
eigenstate. Eq. 



.2) implies soundness when f{x) = 0. 



In fact, the proof of Theorem 9.1 requires two quantum algorithms, one for each of the bounds 



in Eq. (9.3) 



1. The proof that Q{f) = 0(|| abs(74G) ||/A) is based on Szegedy's correspondence between 
co ntinuou s- and discrete-time quantum walks |Sze04j . The proof is nearly the same as 
in RS08| Appendix B.2]. The differences are that we are only assuming an effective spectral 



gap in the case f{x) = 0, and that the graph G in Theorem 9.1 is not required to be bipartite. 
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The graphs to which we apply Theorem 9.1 below will be bipartite, though, since they will 
be derived from span programs. 



This algorithm applies to the formula-evaluation applications. Theorem 1.1 Theorem 7.3 and 
Theorem 7.6 In each case, a span program P is given and the algorithm run with G = Gp. 



In addition to lower-bounding A, the query and time complexity bounds require showing that 
||abs(^G)|| =0(1). 

2. The second bound, Q{f) = 0(1/A), is applicable in the more typical case when we do not 
know an upper bound on || abs(AG')||. The idea is to apply phase estimation to e*'^'^^^). Since 
Ag is independent of the input x, recent work by Cleve et al. shows that its norm does 
not matter if we can concede a logarithmic factor in the query complexity |CGM^08 . For 
applying phase estimation, there is still the problem that eigenvalues can wrap around the 
circle, e.g., e^^^ = e^^, leading to false positives. To avoid such errors, we scale vIgj-^) by a 
uniformly random number R G (0, 144/e^). 



Although [Theorem 9.1 refers only to query complexity, and not time complexity, the first 
algori thm's time complexity can also often be bounded under reasonable assumptions on G. See 
Refs. (RS081 lACR+071 IC^W09] for details. 



For a span program P, the graphs Gp and Gp{x) from Definition 8.2 are of the form required by 

and 



Theorem 9.1 The assumptions Eqs. 



conclusions of Theorem 8.3 and Theorem 8.4 



).l 



(9.2) for [Theorem 9.1 are also of the same type as the 



Therefore, assuming for the moment Theorem 9.1 



as corollaries we obtain quantum algorithms for evaluating span programs: 

Theorem 9.2. Let P be a span program and D C B" . Then the quantum query complexity of fp 
restricted to T> satisfies 



Q{fp\v) = 0{wsize{P,V) 



log wsize(P, T>) 
' log log wsize(P, V) 



(9.4) 



Proof. Set c = 1/8 in Theorem 8.3 and apply Theorem 9.1 with /i the output vertex of Gp, 
e = 1/2 and A = c/wsize(P, V) . □ 

Theorem 9.3. Let P be a span program with target vector \t) and input vectors \vi) for i £ I = 
Ihee U Uje[n] b€B ^j,b' inner product space V. Let V C B'"- and assume that for some Wi, W2 > 1, 



max min \\\w)\\ < Wi 

x&V:fp{x) = l \w)eC': 

An{x)\w)=\t) 

max min {\\\w')f + \\A^\w')f)<W2 

i:&V:fp{x)=0 |w)')ey: {t\w') = l, 
Ii{x)A^w')=0 



(9.5) 



Let P' be the same as P, except with the target vector \t) / \/Wi. Then fp can be evaluated on 
inputs in T> using 

O^WiWiW abs(ylG^,)||) = 0{^WiW2\\ abs(AGp)ll) (9.6) 
quantum queries, with error probability at most 1/3. 
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Proof. Apply 



Eqs. (9.1 



Theorem 8.4 



(9.2; 



to P' with T 



^/VVm. Then 



Theorem 9.1 



and 

tum algorithm follows. 
Finally, since Wi > 1 



hold with e = 1/2 and A = T. An O {^/WlW^^ahs{A^ 
abs(AG^,)|| < ||abs(AGp)||. 



's assumptions 
I) -query quan- 

□ 



In the rest of this section, we will prove 



Theorem 9.1 



relying heavily on [RS08' and |CGM+08 



As sketched above, there are two parts to the proof, given in Section 9.1 and Section 9.2 below. 
For X G -B", let Ox be the phase-flip input oracle defined by 

:|6,j)^(-l)^^^|6,j) 

for b G B and j G [n] . 



(9.7) 



9.1 Algorithm using the Szegedy correspondence 
Proposition 9.4 ([RSOSj). Under the assumptions of 



Theorem 9.1 



f can be evaluated with error 



probability at most 1/3 using 0{\\ abs(^G)||/A) queries to the input oracle 



The proof is basically the same as for the algorithm in |RS08| Appendix B.2], which in turn 
was closely based on the algorithms in CRSZ07 |ACR"'"07] . However, the arguments in | RS08 



were tied to the formula-evaluation application, whereas Proposition 9.4| is in a more general set- 
ting. In particular, |RS08j could assume a spectral gap in the case f{x) = 0, whereas we only 
have Eq. |(9.2) an "effective" spectral gap. This weaker assumption means that establishing the 
algorithm's soundness requires somewhat more care. 

The key technical ingredient in the proof is a theorem due to Szegedy |Sze04] that we apply 
to relate the spectrum and eigenvectors of ^g(x) to those of a discrete-time coined quantum walk 
unitary. We use a formulation of the theorem essentially the same as given in |ACR+n7| . However, 
the statement there had a minor typo (in |a;,±) below). This typo did not affect their application 
or the application in [RS08J, but would matter for us here. Therefore, after stating the corrected 
theorem, we also repeat the proof from |ACR"'"07j . which was correct. 

Theorem 9.5 ( (Sze04j ). Let V be a finite set. For each v £ V , let l^^t,) S be a length-one 
vector. Define T E £(C^, ® C^), S,U e C{C^ C^) and M G £(C^) by 



T = Y,{\v)'^\^v)){v\ 
U = {2TT^ - 1)S 



V, UJ){W, v\ 



v,wGV 



M = T^ST= {^v\w){v\ip^)\v){w\ 



(9.8) 
(9.9) 



v,wGV 



Since T^T = 1, U is a unitary. (U is a swap followed by the reflection about the span of the vectors 
{\v) ® \(pv) : V € y}-) M is a Hermitian matrix with \\M\\ < 1. Let {|a)} be a complete set of 
orthonormal eigenvectors of M with respective eigenvalues p{a). 

Then the spectral decomposition ofU corresponds to that of M as follows: Let Ra = Span{T|a), ST\a)}. 
Then Ra -L Ra' for a 7^ a' ; let R = (BaRa- U is —S on R^ , and U preserves each subspace Ra- 

If |p(q!)| < 1, then Ra is two-dimensional, and within it the eigenvectors and corresponding 
eigenvalues of U are given by 



a, ±) = (1 - (p(a) =F i^Jl- p{aY)s)T\a 



A(a, ±) = p{a) lb i\/l — p{aY ■ 



(9.10) 
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If p{a) € {1,-1}, then ST\a) = p{a)T\a), so Ra is one- dimensional; let 
A(q!, +) = p{a) he the corresponding eigenvalue of U . 



T\a) and 



Proof. This proof is taken from |ACR"'"07 



First assume a / a', and let us show R^ -L Ra'- Indeed, {a\T'^T\a') = {a\a') = 0, as T"^T = 1. 
Since 5^ = 1, similarly, ST\a) is orthogonal to ST\a'). Finally, {a\T^ ST\a') = {a\M\a') = 0. 
Therefore, the decomposition ® = (0q, Ra) © -R"*" is well-defined. 

R is the span of the images of ST and T. 2TT'^ — 1 is +1 on the image of T and —1 on its 
complement; therefore U is —5 on R^. 

Finally, TT'^T = T and TT'^ ST = TM, so 

U{ST\a)) = {2TT^ - l)T\a) = T\a) 
U{T\a)) = {2TT^ - l)ST\a) = (2p(a) - S)T\a) ; 



U fixes the subspaces Ra- 

For the case that \p{a)\ < 1, let 
proportional to if /3(2/?(a) + /3) 



= (1 + pS)T\a). Then = {2p{a) + 0)T \a) - ST\a) is 
1; i.e., 13 ■■ 



follows. 



p{a) ± iy^l -p(a)2. Eq. |(9.10) 
If p(a) G {-1,1}, then since ((a|rt)(5r|a)) = {a\M\a) = p{a), T\a) = p{a)ST\a). Therefore 
Ra is one-dimensional, corresponding to a single eigenvector of U with eigenvalue p{a). □ 

We will need slightly more control over the eigenvectors |a, ±): 

Lemma 9.6. With the setup of Theorem 9.5, for any lip) G C^, the eigenvectors |a,±) with 
|p(a)| < 1 satisfy |||a,±)|| = y^2(l — p(a)^) and 

MT^\c^,±)f _ 1 
lll«,±)f 2 



(9.11) 



Mien |p(a)| = I, \\\a,+)\\ = 1 and {ip\T''\a,+) = {p\a) . 

Proof. Fix an eigenvector \a) of ^g(x) and let p = p(a). Assume that < 1. We have 



a,±> 



(a|Tt(l 



^iti arccos 



j,=pi arccos p 



5)T|a) 



(Q|Tt2(l -p5)T|a) 
2(l-/9(a|rt5r|a)) 



(9.12) 



= 2(l-p^) , 

where we have used S'^ = T^T = 1, |||a)|| = 1, and T'^ ST = M. Also, then, we compute 

(V^|rt|a,±) 



(V^|r(i-, 
(V^ITtria) 



^=p« arccos p 



3=pi arccos 



arccos p-i 



5)r|a) 

^(V^lTt^Tla) 



|a)(l - 
|q)(1-/52^W1-p') , 



(9.13) 



so 



a)|^(l-p2). Eq. (9.11) 



follows. 



mT^a,±)\^- 

When |yo(a)| = 1, the claims are immediate from |a,-|-) = T\a) and T'^T = 1. 



□ 
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We can now prove Proposition 9.4 



Proof of Proposition 9.4 Notice that if we scale Aq, ^G(a:) ^-iid A all by 1/|| abs(^G)ll) then both 
assumptions Eq. (9.1) and Eq. (9.2) still hold. Therefore we will assume below that || abs(j4G)|| = 1. 



Our goal is to evaluate / using 0(1/A) queries to the phase-flip input oracle of Eq. (9.7) 



Assume that G is a connected graph; otherwise, discard all components other than the one 
containing the vertex fi. Therefore abs(AG') has a single principal eigenvector \6), ahs{AG)\S) = \6), 
with {v\6) > for ah v £V. 

Put an arbitrary total order "<" on the vertices in V. For each v GV, let 



Then 



—^(^{v\Ag\v){v\6)\v)+ Y1 V\{v\Mw)\{w\6)\w)+ Y1 



<w 

(v\Ag\w)^0 



{w\Ag\v) 
V\{v\AgH\ 



Aw {v\aMAG)\w){w\6) 



(9.14) 



(9.15) 



w 



1 . 



Therefore 
be the unitary 



Theorem 9.5 



will apply; define T, S, U and M from Eqs. (9.8) 



and 



— \v, w) 
\v, w) 



if w e Vj^x, ^ Vinput for some j G [n] 
otherwise 



.9)1 Also let Or, 
(9.16) 



Ox\v,w) -- 

One controlled call to Ox can be implemented using one call to the standard phase-flip oracle O. 



of Eq. (9.7) 



The algorithm has three steps: 

1. Prepare the initial state T|/i). 

2. Run phase estimation on Wx = iOxU, with precision 6p = ^A and error rate 6e = e/6. 

3. Output 1 if the measured phase is or vr. Otherwise output 0. 

Phase estimation on a unitary W with precision 5p and error rate Se requires 0{l/{5p5e)) 
controlled applications of W |CEMM98] . Since e = 0(1), the query complexity of this algorithm is 
therefore 0(1/A). It remains to prove completeness and soundness. 

Fix an input x £ B^. For v £ V, let 



\v) if v G Vj,Xj for some j G [n] 
\ipv) otherwise 



(9.17) 



Apply Theorem 9.5 using the vectors \(pf,) to define Tx, Ux and Mx- 

Lemma 9.7. M = Ac and Mx = ^g(x)- Moreover, letting = Span{{\v,w) : {v,w) G E}) C 
(8> be the span of the edges of G, Ux\ce = OxU\ce and Tx\^i) = T\ijl) G . 
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Proof. First, note that for any vertices v,w £V, from Eq. (9.9) and Eq. (9.14) 

{v\M\w) = {(py\w){v\ipu]) 

= {v\Ag\w 
= {v\Ag\w 



{w\6)V m 



(9.18) 



Therefore M = Aq- 

Recall that G{x) is the same as G except with the edges to vertices in ^j^[n]^j,Xj removed. 
Consider a u G ^jx, - By assumption, v has a single neighbor 7^ w, so it must be that \ipy 



\w). 



Since = \v), {v\Mx\w) = {if^\w) {v\if^) = 0. However, for all pairs {v,w) that do not make an 
edge leaving some Vj^Xj-, {v\Mx\w) = {v\M\w). Therefore = ^G(a;)- 

Next, we aim to show that UxS and OxUS are the same when restricted to C^. Note that 



US = 2rrt - icv^cv 

= 2 ^ \v){v\ (g) \(Pv){^v\ - lc^®c^ 

Similarly U^S = J2v bX^I ® {'^\Vv){^v\ ~ ^c^)- Therefore, 

{US)^UxS = ^ \v){v\ [{2\^,){ip.\ - im^'^Ml - 1)] 

V 

= ^ \v){v\(S:l+ ^ \v){v\ (g) {1 - 2\v){v\ - 2\w){w\) 



(9.19) 



(9.20) 



where in the second term w is u 's single neighbor in G. On the other hand, from its definition in 
Eq. 1(9.16)1 



2 ^ (g) Iqv . 



(9.21) 



on C^. 

Finally, since by assumption fi ^ Mnput, ^i'Ia*) = |m) 
Eq. 1(9.14)1 



By inspection, this is the same as Eq. (9.20) 



l'/'P = l/^)®lv^/.)=r|M>- T|/.)GC^by 

□ 



The initial state T\id) = Tx\iJ.) lies in Range(r3;) C C^. Also, Ux fixes C ^; in fact, it even fixes 
the join of the ranges of Tx and STx, which could be smaller than C^. By Lemma 9.7 OxU and 
Ux are the same restricted to C^. Therefore, the algorithm behaves the same as if it were running 
phase estimation on iUx instead of Wx = iOxU. 

Based on Eq. (9.1)[ the algorithm is complete: 

Lemma 9.8. If x &T> and f{x) = 1, then the algorithm outputs 1 with probability at least e — 5e = 



|e, where 5e = e/Q is the phase estimation error parameter. 
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Proof. Assume that /(x) = 1. From Eq. (9.1) _Aq(x) has an eigenvalue-zero eigenvector |a) G 
with |||a)|| = 1 and |(//|a)| > e. By Theorem 9.5 with p{a) = 0, Ux has eigenvectors |a,±) = 



[1 lb iS)Tx\a) with respective eigenvalues iti. By Lemma 9.6[ these satisfy 



\{f,\Ti\a,+)\ , MTl\a,-)\ 2. 

+ — — = K^|a)| >e- 



(9.22) 



Thus the algorithm measures a phase of or vr, and outputs 1, with probability at least e — 6e- □ 



Based on Eq. (9.2) since the phase estimation precision is 6p = -A, the algorithm is sound: 



Lemma 9.9. If x € D and f{x) 
e/2 + 5e = \e. 



0, then the algorithm outputs 1 with probability at most 



Proof. Let {\a)} be a complete set of orthonormal eigenvectors of Aq(^x)j with corresponding eigen- 
values p{a). The initial state T|/x) = Tx\n) lies in the range of Tx, and therefore is in the span of 
the eigenvectors {|a,ib)}, i.e., the space R = ®aRa from Theorem 9.5 The probability that the 
algorithm outputs 1 is therefore at most 5e plus 



E 

\a,b): 

arg(A(a,6))6[f-<5p,f+5p]U[-f-<5p -f+5p] 



l(Q;^lA^)r 
lll«,^)f 



o:|arcsin p{oi)\<.5p 



\{a,+\li)\ ^ |(«, -1^)1^ , 

III , \l|2 III \||2 ) ly-^-aJ 



where in the first sum b can be either -|- or — , and we have used A(a, it) = g±« arccos p(o) ^ 
arg(A(Q;, ±)) = ib(| — arcsin p{a)). 

Since |arcsinyo(a)| < ^|/9(q!)|, and bylLemma 9.6 the above sum is at most 



o:|p(a)|<A 



(9.24) 



which is at most e/2 by Eq. |(9.2' 



□ 



Therefore, the algorithm is correct. The constant gap e/6 between its completeness and sound- 
ness parameters can be amplified as usual. □ 



9.2 Discrete-time simulation of a continuous-time algorithm 



Proposition 9.10. Under the assumptions of Theorem 9. 1\ f can be evaluated with error probability 
at most 1/3 using 0(-^ log(-^)/loglog queries to the input oracle Ox- 



[Proposition 9.4| and Proposition 9.10] together prove Theorem 9.1 



To prove Proposition 9.10 we will first give an algorithm in the continuous-time query model. 



This algorithm uses the same idea as the algorithm from Proposition 9.4 Namely, we run phase 
estimation on a certain unitary. Completeness of the algorithm is derived from Eq. (9.1)| and 



soundness derived from Eq. (9.2) 



Then we simulate this continuous-query algorithm in the discrete-query model. The key tech- 
nical step is a recent result due to Cleve, Gottesman, Mosca, Somma and Yonge-Mallo, |CGM+08 



that states that continuous-query algorithms can be simulated by discrete-query algorithms with 
only a logarithmic overhead. We quote here a weak version of their theorem. 
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Theorem 9.11 f lCGM+OSp . Suppose we are given a continuous-time query algorithm with any 
driving Hamiltonian D{t) whose operator norm \\D{t)\\ is bounded above by any Li function with 
respect to t. (The size of \\D{t)\\ as a function of the input size N does not matter.) Then there 
exists a discrete-time query algorithm that makes 



T 

0[ ' "° 1 (9.25) 



5 log log f 

full queries and whose answer has fidelity 1 — 6 with the output of the continuous-time algorithm. 



We will not define the continuous-time query model here; see |CGM+n8l for details. For other 



apphcations of the model, see, e.g., |FG98[ IMoc07[ IFGG07[ ICCD+03 



Proof of \Proposition OTO We start by presenting and analyzing the continuous-time query algo- 
rithm. 

The rough idea is to run phase estimation with precision A on the unitary e*"^'^(^). Output 1 
if the estimated phase is zero, and otherwise output 0. This algorithm belongs in the continuous- 
query model, because ^g(x) is the sum of an input-independent term Aq and an oracle-dependent 
term 

^G(x)-^G = - (I^X^I + I^X^I) • (9-26) 



However, this algorithm would not be sound. When f{x) = 0, the problem is that even though 
Ag{x) has an effective spectral gap, that does not imply that there is an effective gap in the phases 
of the eigenvalues of e^^G{x) _ Each eigenvalue p G R of ^^{i:) corresponds to the eigenvalue e*'' 
of e*'^'^(^), and therefore large eigenvalues can wrap all the way around the circle. For example, 
an eigenvalue-(27r) eigenvector of ^g(x) is an eigenvalue-one eigenvector of e*'^'^*^), which phase 
estimation will not distinguish from an eigenvalue-zero eigenvector of ^g(x) • 

We solve this issue by scaling ^g'(x) by a uniformly random T G/j (0,t), where r is a large 
enough constant. Intuitively, this means that for any eigenvector \a) of Aq(^^-^ with eigenvector 
p{a), \p{oi)\ > A, there is only a small chance that Tp{a) wraps around into the interval [—A, A]. 

We will analyze the following concrete algorithm: 

1. Let M = [12/e] = 0(1). Let r = M^/A. Let T be a random variable chosen uniformly from 
the interval (0,r). 



2. Prepare the initial state 



L( 



M 



m=l 

3. Apply e'''^M'^G(x) second register, controlled by the value m in the first register. That 

is, apply the unitary 

Y e'^S^Gw = exp (^zT ^ ® ^g(x)) • (9-28) 

me[M] me[M] 
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The resulting state is 



^ |m) (g) e*'^sf^GW|^) 



(9.29) 



me [A/] 



4. Project the first register onto the uniform superposition X^meA/ 1"^)- Output 1 if the 



projection succeeds, and output otherwise. 



This algorithm is essentially running a slightly simplified version of phase estimation. We have 
chosen to write it out concretely, instead of using phase estimation as a black box, partly in order 
to illustrate that full phase estimation is unnecessary when the objective is just to decide whether 
or not the phase is zero. When there is a large gap between the parameter on the right-hand side 
of Eq. 1(9.1) and that on the right-hand side of Eq. (9.2) the procedure becomes especially simple. 
(In fact, for our application of Theorem 9.1 to span programs, the gap can be made a constant 



arbitrarily close to one.) A similar simplification can be made in the proof of Proposition 9.4 
Lemma 9.12. When run with input x £ T>, the above procedure satisfies: 

• If f{x) = 1, then it outputs 1 with probability at least e. 

• If f{x) = 0, then it outputs 1 with probability at most 3e/4. 

Proof. Let {|a)} be a complete set of orthonormal eigenvectors of j^gr^^.), with corresponding eigen- 
values p{a). The probability that the procedure outputs 1 is the expectation versus T of 



Pr [output l\T = t\ 



1 

M2 



mG[A/] 



M2 
1 



e M 



OL m6[Af] 
me [A/] 



(a|^)|Q) 



Ka|/x)r 



(9.30) 



When f{x) = 1, we have from Eq. (9.1) that 'Yl,a-p{a)=Q K*^!/^)! — so Pr [output \\T = t] > e, 
regardless of t. 

For the case /(x) = 0, we split the sum over a into a sum over those q with |p(a)| < A and a 
sum over those a with \p{pL)\ > A. By Eq. (9.2)| the first sum is at most M^e/2: 



Pr [output 1\T = t] < ^+ ^ 



M2 



E IE 

a: |p(a)|>A me [A/] 



Ka|/.)r 



).31) 



Now use 



and, for p{a) / 0, 



IE 

me[Af] 



l,m&[M] 



Et [e 



M 



IT 



l—m 

M 



p{a) 



(9.32) 



(9.33) 
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Substituting back into Eq. (9.31) 



gives 



Pr[outputl] <| + ^ E (^+ E 



a: |p(o)|>A 



«,me[M] 



ji^Tvf P(") _ 1 



|(a|/x)r 



e 1 
2^M 



a: |p(a)|>A 



i,me[Af] 



i(l — m) 



(9.34) 



-2 M 



1 / 2M^ 



a: |p{a)|>A 



where in the last step we have (loosely) bounded the sum over / and m. Now use Yla I ("^1^)1 = 
r = M^/A and M > 12/e to conclude 



Pr [output 1] < ^ + A 



(9.35) 



as claimed. 



□ 



Therefore, the above procedure is correct. It remains to sh ow that it can be simulated using 
0{t log t/ log log r) queries to the input oracle Ox from Eq. (9.7) The difficulty is simulating e^^^^^^ 
for a t G (0,r), where 

^(^)= E 5l"^)H®^G(x) • (9-36) 

me[Af] 

In the language of physics, e**^^^^ corresponds to applying the time-independent Hamiltonian H[x) 
for a time t. 
Let 

^= E ^■"^X'^I^^G , (9.37) 

m.e[M] 

the "driving Hamiltonian." D is independent of the input x, so e**'^ can be implemented without 
querying Ox- Let the "query Hamiltonian" be 



me[M] 



E -^\^)^^\® E i\v){w\ + \w){v\) , 



(9.38) 



me [A/] 



where we have used that G{x) differs from G only in the deletion of the weight-one edges leaving 
the vertices v G Ujg[„]V^-_Xj • For an arbitrary i G R, e**^^ can be implemented using at most two 
queries to the oracle Ox- 
Then 

H{x) = D + Hx - (9.39) 
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The problem for taking the exponential is that the two terms D and do not commute. 

We will now apply Theorem 9.11 which very roughly can be thought of as an asymmetric 
Lie- Trotter expansion of the exponential. A minor difference between our setting and the one 
in |CGM"'"08| . though, is that they assume a more restricted form for the query Hamiltonian. For 
querying a /c-bit string y with the first bit fixed to yi = 0, they assume the query Hamiltonian is 



(9.40) 



Unfortunately, our query Hamiltonian Hx is not of this required form. In order to apply Theo- 



rem 9.11] as a black box, we need to put into this form for some string y. Each bit of y will 



be a fixed function of exactly one bit of x, and therefore a discrete phase- flip query on y can be 
simulated with one application of Ox- 

First of all, note that Theorem 9.11 still holds if the query Hamiltonian is of the form 

H'y=Y.y,gmm\ , 

where g is any fixed function [k] {—1, 1}- That is, signs are allowed. Indeed, then 



(9.41) 



H'y 



i6[fc]:g(i)=-l 3<^[k\. g{j)=l 



+ (i-%-)U)oi 

i6[fc]:g(j)=-l 



(9.42) 



The first term can be moved into the driving Hamiltonian, since it does not depend on y, and 
the remaining terms are of the form of Hyi on an input y' that equals y except with the bits 
{j £ W\ '■ 9{j) = ~1} complemented. 

Let us now translate our query Hamiltonian Hx into the form of Eq. (9.41) For m E [M], let 

D"" = \m){m\ (g) Ag (9.43) 
H^ = -\m){m\^ Y {\v){w\ + \w){v\) (9.44) 

H'^ix) = D"' + H^ = \m){m\ Ag(x) ■ (9.45) 



Then H{x) = E„e[M] t^'"!^), so 



n exp(iigi?™(x)) 



me[M] 



(9.46) 



since the different terms H™'{x) commute pairwise. 

The term is nearly of the form Eq. (9.41) It can be put in that form by changing basis. 
For j £ [n], b £ B and v € Vj^h C Finput, with neighbor w, write 



Iv^wl + \w){v\ = \vw+){vw+\ — \vw—){v'w- 



(9.47) 



where \vw±) = -^ilv) ± l""^))- Use two bits of y, with values Xj and xj, to get the terms ^\m){'m\ 
±){vw±\ from Eq. |(9.44)| into the form of Eq. |(9.41) " 



vw 
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Overall, therefore y has \Vj^h\ copies of bit Xj and \Vj^h\ copies of the complement xj, for all 
j £ [n], b £ B. Thus k, the length of y, is 2|yinput|- 

with accuracy parameter 5 



Finally, apply Theorem 9.11 



12M 



^2(1), M times, once 

for each of the terms in Eq. (9.46)| The total query complexity is 0(MTlog(T)/loglogr) = 
0(-^ log(-^)/loglog ■^), as desired. The total error introduced in the simulation is at most M6, 
so the gap between the completeness and soundness parameters of the final algorithm is at least 
e/4 — 2 • e/12 = e/12. This constant gap can be amplified as usual. □ 



10 The general quantum adversary bound is nearly tight for every 
boolean function 

We can now prove the main result of this paper, that for any total or partial boolean function / 
the general adversary bound on the quantum query complexity is tight up to a logarithmic factor. 



Theorem 10.1. For any function f : D 
query complexity of f, Q{f), satisfies 



{0,1}, with D C {0,1}", the bounded-error quantum 



and 



Qif) = S!(Adv±(/)) 



V loglogAdv=^(/) 



:io.ii 



flO.2) 



Proof. The lower bound is a special case of 



Theorem 2.6 



and is due to H0yer, Lee and Spalek |HLS07 



As alread y sketched in Section 1 for the upper bound, use the semi-definite program from 
Theorem 6.1 with uniform costs s 
with wsize(P, P) = Adv^(/). Then apply 



algorithm that evaluates /. 



1 to construct a span program P computing fp\z) = /, 
to obtain a bounded-error quantum query 

□ 



Theorem 9.2 



By using binary search and standard error reduction. Theorem 10.1 can be extended to cover 
functions with larger codomain [Lee09| : 



Theorem 10.2. For any function f : T> - 

g(/) = i^(Adv±(/)) 

and 

Q(/) = ofAdv±(/) 



\m\ 



with V C {0, 1}", Q{f) satisfies 



logAdv^(/) 
loglogAdv±(/) 



log(m) log log m 



(10.3) 



(10.4) 



Proof. The lower bound is again due to [[HLSOT]. To derive the upper bound, first let us show: 

E and g : E ^ F. Let s £ [0, oo)''. 



Lemma 10.3. For finite sets V <ZC"-, E and F, let f :V - 
Then 

Adv,(5o/) < Adv,(/) 
Adv±(go/)<Adv±(/) 



(10.5) 
(10.6) 
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Proof. For x,y ^ D, f{x) = f{y) implies g{f{x)) = g{f{y))- Therefore if T is an adversary matrix 
for go f : D ^ F, then F is also an adversary matrix for /. The conclusions follow by Definition 2.4 
for the adversary bounds. □ 

In order to evaluate /, apply standard binary search using [log2 m] steps. In each step, there 
is some division of the range g : [m] {0,1}. By [Lemma fosl Adv=^(c/o/) < Adv=^(/). Therefore 



by Theorem 10.1 g o f can be evaluated with error at most 1/3, using 



V ^'MoglogAdv±(/) 



(10.7) 



queries. Repeat this O(loglogm) times in order to reduce the error probability to 1/(3 [log m]). 
Then by the union bound, the entire procedure has a probability of error at most 1/3. □ 

We do not have a result for the case of a non-binary input alphabet. Of course the input can be 
encoded into binary, so that Theorem 10.1 applies. However, this encoding might increase Adv^ 
significantly. 



11 Open problems 

We have shown that for any boolean function /, the general adversary bound Adv^(/) is a tight 
lower bound on the bounded-error quantum query complexity Q(/), up to a logarithmic factor. In 
proving this statement, we have also shown that quantum algorithms, judged by query complexity, 
and span programs, judged by witness size, are equivalent computational models for evaluating 
boolean functions, again up to a logarithmic factor. 



Among the corollaries. Theorem 7.6 gives an optimal quantum algorithm for evaluating adversary- 
balanced formulas over any finite boolean gate set. For example, the formula's gate set may be 
taken to be all functions {0, 1}" — > {0, 1} with n < 1000. This formula-evaluation algorithm exploits 
the ease of composing span programs. The main unresolved problem here is how best to evaluate 
unbalanced formulas, aiming for optimal query complexity and near-optimal time complexity. 

Span programs may also be useful for developing other quantum algorithms. They have a 
rich mathematical structure, and their potential has not been fully explored. One possible ap- 
proach is to study the general adversary bound for more problems. For example, studying the 
Barnum/Saks/Szegedy semi-definite program for quantum query complexity |BSS03] has led to 
improved zero-error algorithms for Ordered Search |CLP07j . The Adv^ SDP is simpler than the 



SDP in |BSS03] . and Theorem 6.2 gives a new, simpler form for the dual SDP, for boolean func- 
tions. Although this SDP is still exponentially large, the simplifications may ease the inference 
of structure from numerical investigations. For the Ordered Search problem in particular, Childs 
and Lee have closely characterized Adv^ |CL08] . This result will not necessarily be useful for 



developing an Ordered Search algorithm because the codomain is not boolean and Theorem 10.1 
has a logarithmic overhead. A variation of this problem, Least-Significant-Bit Ordered Search, has 
boolean codomain, but is of less practical interest. 

The nonnegative-weight adversary bound Adv is often easy to approximate. If this bound is 
close to Adv^, then perhaps a solution to Eq. (6.5) the SDP dual to the Adv SDP, can also be 



turned into a quantum walk algorithm. However, the span program framework will not apply for 
the analysis. 



55 



This article has focused on query complexity, but Theorem 9.1 is more than an information- 
theoretic statement. It gives explicit algorithms whose time complexity can be analyzed, as in 
Theorem 7.6 for formula evaluation. Proposition 4.7, Theorem 8.4 and Theorem 9.3| are pertinent 
results, but more techniques are needed for developing span programs P such that || abs(AG'p)|| = 
0(1) and for which the quantum walk reflections from Szegedy's Theorem 9.5 can be implemented 
efficiently. 

It is an interesting problem to consider functions with non-binary input alphabet and non- 
boolean codomain. The three main theorems. Theorem 6.1 Theorem 8.3 and Theorem 9.1, may 



extend to cover partial functions with domain in [k]"' and k = 0(1). When the codomain is not 
boolean, we would like to strengthen Theorem 10.2[ The natural approach is to define generalized 



canonical span programs and extend Lemma 6.5 to characterize the optimal generalized witness 
size of f : C ^ E [RSOe]. Although this may lead to new quantum query algorithms, it will 
be insufficient for obtaining provably optimal or near-optimal algorithms for non-binary input 
alphabets, since the SDP in Eq. (6.2) is not always equal to Adv^; see Eq. (6.6), Moreover, there 
are functions [3]^ [3] for which both Adv^ and the SDP in Eq. (6.2) compose strictly sub- 
multiplicatively, which indicates that the formula-evaluation problem for non-boolean gate sets is 
more complicated. 

One might ask whether the classical query complexity of evaluating a span program P on 
inputs in D can be related to the witness size wsize(i-*, P). A polynomial dependence is not pos- 
sible, though, since there is only a polynomial relationship between quantum and classical query 
complexities for total functions |Sim971 lBBC"'"Oi] . 

An 



Finally, we conjecture that the logarithmic overhead can be removed from Theorem 10.1 



analogous conjecture may hold in the continuous-time query model ^FG98l IMocO?! ICGM+08] . 



Conjecture 11.1. For any function f : D 
adversary bound is tight: 

Qif) = e(Adv±(/)) 



{0, 1}, with D C {0, 1}", the general quantum 

(11.1) 
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A Optimal span programs for the Hamming- weight threshold 
functions 

In this appendix, span programs with optimal witness size are given for the Hamming-weight 
threshold functions. Additionally, optimal span programs are given for those Hamming- weight 
interval functions for which the nonnegative-weight adversary bound equals the general adversary 
bound. The motivation is to show an explicit and nontrivial span program construction. The 
main technique, recursive composition of symmetrized span programs, may be useful for other 
constructions. 

Surprisingly, the optimal span programs are simply derived from span programs for AND and 
OR gates, composed in a certain symmetrical manner and with optimized weights. The optimal 



span programs for Threshold 2 of 3 and Threshold 2 of 4 given in |RS08j did not have this form. 
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The proofs are simple calculations. After presenting the span programs, we compute their 
witness sizes, compute the best nonnegative- weight adversary bounds (by giving adversary matrices 
and solutions to the dual formulation), and show by perturbations of these matrices that the general 
adversary bound is strictly greater in those cases where the span program witness size does not 
match the nonnegative-weight adversary bound. 

Definition A.l. The Hamming-weight threshold function : {0, 1}" {0, 1} is defined by 

Tnx) = l' (A.1) 
10 otherwise 

where \x\ = Y17=i -^i Hamming weight of x. 

The Hamming-weight interval function : {0, 1}" {0, 1} is defined by 

'^"W = ln " (A.2) 

I otherwise 

Note that Tp = and, for all x E {0, 1}", Il'^^ix) is the conjunction Tp{x) A T^_^{x), where 
X is the bitwise complement of x. Also, Tl^,^{x) = which allows us to assume without 

loss of generality that |^ — m\ < \ ^ — l\. 

Theorem A.2. For the interval function assume that \ ^ — m\ < \ ^ — l\. Then 

[ {m + l){n — m) if I = 

Ifl£ {0, l,m}, then Adv±(/[^„) = Adv(/;;^); otherwise Adv±(/;"^) > Adv(//;^). 
There exists a span program P"^ computing fpi^^ = I]^ra' '"'^^^ witness size 



wsize(P,%) <\l{m + l)(n - m) + ^^"^ | + |^ . (A.4) 
V m — L + \ 

This witness size matches Adv(/"^), and hence is optimal, for I G {0,1, m}, i.e., in those cases 
whereAdv^{ipj=Adv{Il^^J. 

Our span program construction for the case / = and m = n — 2 has been influenced by a 
family of constructions due to Ambainis that come arbitrarily close to optimality |iAmb08| . 

We will use the following notation. For i £ [n] = {1,2, . . . ,n}, let e* = O^-^IO""* E {0, 1}" be 
the bit string with a 1 only in position i, and for x G {0,1}", let i S x mean Xi = 1 and i ^ x mean 
Xi = 0. Let © denote the bitwise exor operation. 

For computing the nonnegative-weight adversary bounds, we will use a dual formulation that 



is a simplified version of Eq. (6.5) 



Theorem A.3 ([SSOe]). Let f : {0, 1}" ^ {0, 1}. Then 

Adv(/) = min max = , (A. 5) 

{p.}x,y:f(x)^fiy) Y.i:x,^y, ^/ Px{i)Vy{i) 

where the first minimization is over distributions px on [n] for each x £ {0, 1}" . 
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A.l Span programs for the threshold functions 

Proposition A. 4. For I G [n], there exists a span program computing fpn = T", with witness 
size 

wsize(P;") < y/l{n-l + l) . (A.6) 

Proof. The proof is by induction in /. For the base case, / = 1, is the OR function, for which 
an optimal span program has V = C, target vector |t) = 1 and, for i € I = [n], input vector 
\vi) = 1 labeled by (z, 1). For this span program, the witness size for inputs x of Hamming weight 
\x\ = j > 1 is achieved hy \w) = j J2i£x K)' ^^"^ witness size for x = 0" is n. 

For i S [n], let X-i = xi . . . . . . x„ G {0, l}"^-'^ be the string x with the ith bit removed. For 

/ > 1, the span program for T" can be built recursively, by expanding out the formula 

n 

Tp{xi,...,xn) = \/ {x^^T[^~Hx.,)) . (A.7) 
1=1 

By induction, let Pj^i^ be an optimal span program for 7]"^^, over a vector space of dimension 
d with target vector \t') = (1,0, .. . ,0), and with witness sizes 1 for inputs of Hamming weight 
/ — 1 and witness sizes (/ — l)(n — / + 1) for inputs of Hamming weight 1 — 2. We construct span 
program over the vector space V = C ® (C" 03 C*^), of dimension 1 + nd. Let the target 



vector be \t) = (1,0). For the iih. term in Eq. (A.7), add the following "block" of input vectors: 
(1, \/l — l\i) ® \t')) labeled by (i, 1), and (0, \i) ® \vj)) for each input vector \vj) of Pj^Si on X-i. 

The span program indeed computes T". For computing the witness size of P", note that 
all input bits are symmetrical, so it suffices to consider inputs of the form x = l-'O'^"-'. 

• In the true case, j > I, consider the witness \w) with weight 1/j on each of the input 
vectors (1, \/l — l\i) ^ \t')) for i G [j] and then an optimal witness, of squared length at most 
— 1/j)^ • wsize(P^"^[^, x_i) within each of those TJ^^^ span program blocks. The witness 
size is 



^ J^(l + ((-l)wsize(P»-l,x_j)) < 1 . (A.S 



In the false case, j < I, let the witness vector \w') £ V orthogonal to the available input 
vectors be \w') = (l, — ^J—^ Ylii^x N) ® Here is an optimal witness vector for the 

span program PJ/L^^ on i.e., orthogonal to the available input vectors and with {t'\w'j) = 1. 
Then {t\w') = 1 and 



i(^x i&x 

= (n - j) + ^ J^ws\ze{P^Sl^X-^) 

idx 



< {n-j)+j{n-l + l) 
= n + j{n — I) 

<l{n-l + l) , (A.9) 

where in the two inequalities we have used wsize^Pj^^^ , x-i) < (Z — l)(n — j + 1) and j < l — l, 
respectively. 
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Thus wsize(P;") < ^//(n - ^ + 1). □ 

Letting size(P) be the number of input vectors of a span program P |KW93j . note that 
size(P") = n and size(P") = n(l + size(P^""^"'^)), which is exponential in I. For example, for 
the three-majority function , size(P2 ) = 9- This size is not optimal, even among span programs 
with optimal witness size. 

In Proposition A. 6 below, we will require slightly finer control over the threshold span program 
witness sizes: 

Claim A. 5. On an input x of Hamming weight \x\ = j >l, the span program Pp constructed in 



Proposition A. 4 satisfies 

wsize(R",x)< ] . (A.IO) 

Proof. By induction in I. The base case, / = 1, was already considered as the base case for the 
induction in the proof of Proposition A. 4 For / > 1, apply Eq. (A.8)| and the induction assumption 
to get 

wsize(P;", x) < 4 5^ (1 + - l)wsize{Pp_\\x-i)) (A.ll) 

1 / / - 1 ^ 

<^1 + 



1 



j-l + 1 

A. 2 Span programs for the interval functions /"^ 

Proposition A. 6. There exists a span program P"^ computing fpn = with witness size 



□ 



wsize(P,^) <\l{m+ l){n - m) + (^-l^) 



when I § — m| < I ^ 



Proof. We use -^"^(x) = Tp{x) A T^_^{x) and combine the span programs P" for and P"_ 



for T"„„ from Proposition A. 4 



Let V and V be the vector spaces for P" and P"_m, with target vectors \t') and \t"), respec- 
tively. As in Proposition A. 4 scale the target vectors so that witness sizes in the true cases are 
at most 1 and in the false cases are at most l{n — / -|- 1) or (n — m){m + 1) for P" and Pn-nn 
respectively. Let V = V (B V" be the vector space for P"^, with target vector 

\t) = (V/(n-/ + l)|t'), V(n-m)(m + l)|t")) G V . (A.13) 

The input vectors for P"^ are exactly the input vectors of P" on input x in the first component of 
V and the input vectors of Pn-m input x in the second component of V . This way, fpj^ = 1 if 
and only if both component span programs evaluate to true, so indeed fp^ = IJ^^- 

Note that all input bits are symmetrical, so the witness size of P"^ on an input x depends only 
on j = 
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In the true case, I < j < m, the witness size is the sum of the squared lengths for witnesses 



for the two component span programs, from Claim A. 5 



wsize(P"^, x) = l{n — I + l)wsize(P", x) + {n — m){m + l)wsize(P^_^, x) 
^ l{n-l + l) (re-m)(m + l) 

~ j - l + l m- j + 1 ' \ ■ ) 

As the above expression is convex up in j £ [l-jm], it is maximized for j £ {l,m}. Since 
I ^ — m| < I ^ — /|, Z(n — / + 1) < (m + l)(n — m), so j = m is the worst case: 

- I + I) 

wsizefP," , x) < + (m + l)(n-m) . (A.15) 

m — / + 1 

• In the false case, either j < I oi j > m, and we aim to show wsize(P"^, x) < 1. Take first the 
case j > I. Consider a witness vector (^-j====\w') , O) S ^ where \w') is an optimal witness 

vector to fpp{x) = 1. The witness size is ^^^J^^^-^-^ wsize(P^"', x) < 1. The case j > m is dealt 
with symmetrically. □ 

A. 3 Adversary bounds for the interval functions /^"^ 
Proposition A. 7. For the interval function IJ^^ with |^ — m| < |^ — /|, 

[ ^y (m + l)(n — m) if I = 

In particular, Adv(T") = y^/(n — / + !). 

Proof. There are two steps to the proof. First we give an adversary matrix T that achieves for 
each i G [n] ||r||/||r o Ai|| = ^J{m + l)(n - m) + ^0^^ if ^ > 0, or y/{m + l){n - m) if / = 0. 
By Definition 2.4 this lowers bounds Adv(/"^). Second, we give a matching solution to the dual 




formulation of the nonnegative-weight adversary bound of Theorem A. 3 in order to upper-bound 
Let 

{x®e'\ + c Yl ^y\] ' (^-1^) 

y:\y\=l-l J 
\x(By\='m—l+l 

where c is to be determined. For the case / = 0, the second term above is zero, so set c = 0. 
Then for each i S [n], let Fj = F o Aj, so 

F,= ^ (x|F|y) 

= \x){xee'\+c J2 Yl I^X^I • (^-^^^ 

x:\x\=m x:\x\=m y:\y\=l—l 

i^x iex \x(By\=m-l+l 
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Then 



E 



E 



\y){y'\ 



(A.19) 



y:\y\=m+l 



y,y ,^ 

\y\ = \y'\=l-l,\x\=m 
\x®y\=\x®y'\=m-l+l 
idx ,i^y ,i(fiy' 



Thus r|rj is the direct sum of two matrices, for / > 0. The first term above clearly has norm 
one, and we want to choose c as large as possible so the second term also has norm one. Now the 
eigenvector with largest eigenvalue for the second sum is, by symmetry, 1-0) = 'Ylix-\x\=i-ii^x 1^)' 
with eigenvalue ( ) ( ) . Thus let 



so ||ri|| = 1. 

Let us determine the norm of T. We have 



||rrt|| 



(V'mirrtiv;. 



where \il^m) = Y.x:\x 



\x\=m 



n)\? = (^). Then 

E e') + c 

a;:|x|=m i^x 



(A.20) 



(A.21) 



E 



y:\y\=l-l 
|a:e?;|=m-/+l 



(A.22) 



^ (m + l)|y)+c 

y:\y\=m+l y:\y\=l-l 



n-l+l ■ 



SO 



irr 



l^.{{rn + l)\rn\i)+c\C,)[:-X\)' 

m ) \ 



+ if/>0 
{m + l)(n — m) if ^ = 



(A.23) 



Theorem A. 3 



For each x, 



This gives the desired lower bound on Adv(Ij 

Next, we need to show a matching upper bound on Adv(/"^), using 
we need a distribution px on [n] . For a function / that is symmetrical under permuting the input 
bits, we look for distributions such that Px{i) depends only on whether Xj = or 1 and moreover 
its values in these cases depends only on |rE|. Thus for i = 0, 1, . . . , n, we fix a pj, < < 1/i (with 
Po = 0) and set p[ = (1 — ipi)/{n — i) >0 (with p'^ = 0). Letting pi and p'^ be the probabilities of 1 
and bits, respectively, when |x| = i, Eq. |(A.5) gives 



E 



P\x\P\y\ 



Adv( f) < min max 

fix)^fiy) ^i:x,=l,j/i=0 ■ i:xi=0,y,=l 



E 



P\x\P\y\ 



-1 



(A.24) 



Fixing |x| = i and \y\ = j, the inner maximum is achieved by x = l*0"~* and y = l-'O""-' because 
these strings have the fewest differing bits. Thus the above bound simplifies to 

-1 



Adv(/) < min max 

{Pi} i<3 

/(l'0"-')^/(PO"-J) 



(A.25) 
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Now specialize from symmetrical functions down to the Hamming- weight interval function / = 
ip^. For i > m + 1, we should clearly set pi as large as possible, i.e., set pi = while for i < / 
we should set p[ as large as possible, i.e., p'^ = l/{n — i). 

First consider the case 1 = 0. Then we should set p[ = l/(n — i) for all i < m in order to 



minimize the expression in Eq. (A. 25) , This gives 



Adv(/oV)< max 



0<i<m J - I ( A 96,] 

m+l<j<n {A.Z,0) 



= ^y {m + l){n — m) , 

where the maximum is achieved at i = m, j = m + 1. 

Now assume / > 0. It turns out that there is some freedom in the choice of pi for I < i < m. 
For i = I, . . . ,ni, choose pi to balance the (I — and (i, m + 1) terms above, i.e., setting 

(^{i-l + l)^/p[I^?j = (^{m-i + l)^p[pm+^ . (A.27) 
Since p'i_i = l/(n — / + 1) and Pm+i = l/(m + 1), this gives 

Pi = {ra+l)(n-i) ^ i-l+l ^2 ' (^-28) 

^ n-l+l \m-i+l) 

Substituting this value for pi back in, the (/ — 1, z) and (i, m + 1) terms are both the square root of 

iin — l + 1) {n — i)(m + l) 

f{n, I, m, z) := /. + ^- '\^,J ■ A.29 

(z — / + 1)^ [m — I + 1)^ 

The case i = m gives the bound we are aiming for. We claim that this is the worst case, i.e., that 
/(n, /, m, i) < f(n, I, m, m) when | § — "m-l < 1 1^ — /|. 
First note that 

52 , , , (n-/ + l)(i + 2/-2) (m + l)(3n-i-2m-2) , 

n, I, m, i) = 2^ '\ + 2^ ^ — > . A.30 

az^ [i — I + 1)^ [m — I + 1)^ 

Thus it suffices to check that /(n, /, m, I) < f{n, I, m, m). Indeed, 

{n-m-l)({m-l + lf -l) 

f{n,l,m,m) - f{n,l,m,l) = rVTvi ■ (A.31) 

(m — t + Ij^ 

Note that / < m. The above difference is clearly >Oifm<|^. Ifm>^, then the assumption 
I ^ — m| < I ^ — /| implies that I < ^ and rn—^ < ^ — l, i.e., m + l < n; so again the above difference 
is > 0. □ 

Proposition A. 8. For the interval function If^, Adv{ip^) < Adv^{IJ^^) if and only if I ^ 
{0, 1, m, n — 1, n}. 
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Proof. For I £ {0,l,m, n — l,n}, AdY{ipj = AdY^ {11" J because 
program P"^ with witness size wsize(P"^) = Adv(/"^), and by 
Adv±(/r^).' 



Proposition A. 6 



gave a span 



i'lieorem 2.8 wsize(P"^) > 



Otherwise, assume that 2 < I < m — 1 and || — < |^ — /|. We wih show that a perturbation 



of the adversary matrix T from Eqs. (A.17)| and (A. 20) in the proof of Proposition A. 7 



||r||/||r o Aj|| for each i £ [n]. The perturbation we consider wih be in the direction of 



A 



E 



x:\x\=m—l 



■ \y\=l~l v.\y\=l-l ^ 



mcreases 



(A.32) 



y\y\ 

\x®y\=m—l 



\x®y\=m-l^2 



where 5 > will be determined later. Let P^*^^ = P + eA. Let Aj = A o A, and P,-'^'' = P^*^^ o Aj 



First of ah, note that f ||p(^) ||/||P 



(^)i 



I 6=0 



0. Indeed, 



de 



1 d 
2||P||5e 



||rW^pW||| 



e=0 



(A.33) 



However, p(^)V(^) = ptp + e'^A^'A since PtA = Atp = 0. Thus |-||P(')||| = 0, and similarly 
Therefore, we need to compute |^ ||P('^ ||/||Pf II I Now 



^ell^i ll|e=0 



0. 



le=0" 



1 



■llptp + e^AtAlll^^g 



=0 2||P||ae2' 



(A.34) 



By the Perron-Frobenius theorem, P^P has a unique eigenvalue of largest magnitude, and it is non- 
degenerate. Letting 1-0) be the corresponding eigenvector, we have by nondegenerate perturbation 
theory 



9e2 



||P(^)|| 



1 



e=0 



(A.35) 



For j = 0, 1, . . . ,n, let iV'j) = T,x:\x\=j 1^)' with |||V'i)|| = (i )• By Eq. (A.21) we may take 



+ c E \yyi 

y:\y\=l-l / 
\x(By\='m—l+l 

(m + l)|V^„+i)+c(^l'+\)|V^,„i) , 



E (Ei^®^ 

a;:|x|=r7i \ i^x 



(A.36) 



so 



AlV') = c ( ) \y^m-i) [{ZZ])-6{ ZSi'-, ) (n - m + 1)] . 



(A.37) 
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Substituting this into Eq. (A.35)[ 



( in \ ( n-l+l \ 
\ m-l+l) 



Ipll / (m+l)(n-m) . 
' " I n-l+1 



r) (n — m + 1) 



1 



(m — /)(n — m + 1) 



(5 . (A.38) 



(m-/+l)^y 

Unlike T^^F, r|rj has a degenerate principal eigenspace. This principal eigenspace is spanned 
by \4>) = T.x:\x\=i-i\x) and \(t)') = Ylx:\x\=m+i\x) ■ Siuce Ai|(^') = 0, we have by degenerate 

i^x i£x 

perturbation theory 

1 d 



^lir(^)|ll -^^iirtr. + eAU-iii 



1 IIA,- 



(A.39) 



Recall that ||rj|| = 1, and note that 



■ n-l ~ 
, l-l , 



Then 



M^)=[{j-l-l)-HnT-l'2)i^-^+^)] E 1^) 



(A.40) 



x:\x\=m—l 

i^x 



Substituting into Eq. (A. 35) 



de 



I i-i I 

(m^2\( n-l \ f, (/-l)(n-m+l) ^^ ^ 



(A.41) 



Now set 5 = ; recall that Z > 2 so the denominator is nonzero. We get ^ Hr^-^^ II L=o ~ 

while £||rW|||^^o > 0. Thus ^||r(^)||/||rf)|||^^Q > o, so Adv(/;;„) < Adv±(//;^). □ 



B Examples of composed span programs 



In order to illustrate the different methods of span program composition used in Theorem 4.3 



and Proposition 4.7 in this appendix we give examples of span program direct-sum composition 



(Definition 4.5), tensor-product composition (Definition 4.4), and reduced-tensor-product compo- 



sition (Definition 4.6). For presenting the examples, we use the correspondence from Definition 8.2 



between span programs and bipartite graphs. 

Our examples will use the following monotone span programs for fan-in- two AND and OR gates: 

Definition B.l. Define span programs Pand cLiT'd PoR computing AND and OR, B, respec- 

tively, by 



-Pand : 



t) 



(B.l) 



PoR- 



t) 



£2 



(B.2) 
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for parameters aj,f3j,5,€j > 0, j £ {1,2}. Both span programs have Ii^i = {1}, l2,i = {2} and 
/free = ^1,0 = h,o = 0- Let a = yafTof. 

Now let If : B he a size-n AND- OR formula in which all gates have fan-in two. By 



composing the span programs of Definition B.l according to (f, we obtain a span program 
computing (/?. The particular composed span program will depend on what composition method 



is used. [Figure 1] gives several examples of tensor-product and reduced-tensor-product composition. 
Much like a canonical span program, the structure of the reduced-tensor-product-composed span 



program is related to the set of "maximal false" inputs to cp. Figure 2 compares reduced-tensor- 
product composition to direct-sum composition, as well as to the graphs used in the AND-OR 
formula-evaluation algorithms of Refs. |ACR"'"07l IFGG07] . Although these algorithms did not use 
the span program framework, the graphs they use do correspond to span programs, built essentially 
according to direct-sum composition of -Pand and Pqr- The small-eigenvalue spectral analysis in 



Theorem 8.7 simplifies their proofs. 

Although not shown here, the different composition methods can also be combined. Hybrid- 
composed span programs will be analyzed in |Rei09j . 

Typical parameter choices for Pand and Pqr are given by: 



Claim B.2. With the parameters in Definition B.l set to 

6 = 1 



(B.3) 
(B.4) 



where Sp = si + S2, the span programs Pand and Pqr satisfy: 



wsize(^_^)(PAND,2;) 
wsize(^,^)(PoR,a;) 



i/x e {11,10,01} 
if x = 00 

i/x e {00,10,01} 

if X = 11 



(B.5) 



that wsize(^^^)(PAND,a;) = wsize( 



It can be seen as a consequence of De Morgan's laws and span program duality (Lemma 4.1) 

'(v^,v^)(-f'oR,S) in [Claim B.2 
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(a) xi V X2 




(c) (xi A X2) V x-i 



01 /3i ^ 




(d) (xi V X2) A xs 




1110 

(e) ((a;i A X2) V 2:3) A xt, 




1325 a'^ 
(f) ((xi A X2) V Ss) A Xi 



Figure 1: In (a) and (b) are given the graphs Gp^^ and Gp^^^, respectively, according to Defini 



tion 8.2 Parts (c) and (d) show tensor-product compositions of these span programs, which are also 



the reduced-tensor-product compositions. Part (e) shows the reduced-tensor-product composition 
of the span programs for a larger formula. Notice that for reduced-tensor-product composition, 
the structure of the graph changes locally as each additional gate is composed onto the end of the 
formula, e.g., going from (d) to (e). However, composing additional gates has a nonlocal effect 
on edge weights. In each graph, the output vertex is labeled and the input vertices are labeled 



by [n]. Similarly to canonical span programs. Definition 5.1 the other vertices are labeled by the 



maximal false inputs to the formula; notice in each example that a vertex labeled with input x is 
connected exactly to those input bits j G [n] with Xj = 0. Part (f) shows a span program for the 
same formula as part (e), except built using tensor-product composition. The vertex 1110 has been 
unnecessarily duplicated. In (e) and (f), there are two AND gates; the primed variables refer to 
the -Pand span program coefficients for xi Ax2. 
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(b) 



0101011 




(c) 




Figure 2: Consider the AND-OR formula (/^(a;) = ([(xi A X2) VX3] A X4) V (x5 A [xeVxy]), represented 
as a tree in (a). Part (b) shows the graph on which ACR^07 runs a quantum walk in order to 
evaluate ip. The graph is essentially the same as the formula tree. The weight of an edge from 
child V to parent p is the 1/4 power of the ratio s^/sp of sizes of the subformula rooted at v to that 



Theorem 8.3 



rooted at p, as in Claim B.2 The only exception is t he weight of the edge to the root, which is 

Part (c) shows the graph one 



and 



Theorem 9.3 



set to for amplification, as in 

obtains by from direct-sum composition of -Pand and Pqr- It is the same as in (b), except with 
two weight-one edges inserted above each internal gate. These edges can be interpreted as pairs 
of NOT gates that cancel out. Including them would slow the ACR"'"07j algorithm down only by 
a constant factor. Part (d) shows a span program derived from the same formula using reduced- 



tensor-product composition only. Vertices are labeled using the same convention as in Figure 1 
Even though every gate has fan-in two, graph vertices can have exponentially large degree. 



70 



